What is the CVSS score of CVE-2026-33436?

CVE-2026-33436 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-33436?

Yes, a patch is available for CVE-2026-33436. Update the affected software to the latest version immediately.

Stirling Pdf CVE-2026-33436

EUVD-2026-23513 LOW

Improper Input Validation (CWE-20)

2026-04-17 GitHub_M

XSS File Upload Stirling Pdf Stirling Tools

3.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 20, 2026 - 19:03 nvd

Patch available

Apr 17, 2026 - 21:16 EUVD

Analysis Generated

Apr 17, 2026 - 21:11 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 20:45 euvd

EUVD-2026-23513

Analysis Generated

Apr 17, 2026 - 20:45 vuln.today

CVE Published

Apr 17, 2026 - 20:29 nvd

LOW 3.1

DescriptionGitHub Advisory

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render user-supplied filenames directly into HTML using unsafe methods like innerHTML without sanitization. An attacker can craft a file with a malicious filename containing JavaScript that executes in the uploading user's browser context, resulting in reflected XSS. The issue affects numerous upload endpoints across the application. The issue has been fixed in version 2.0.0.

AnalysisAI

Reflected cross-site scripting (XSS) in Stirling-PDF versions before 2.0.0 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by uploading a file with a malicious filename containing script code. The vulnerability affects multiple file upload endpoints that render user-supplied filenames directly into HTML via unsafe DOM manipulation methods without sanitization. Attack requires user interaction (victim must upload the crafted file), limiting real-world impact. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Stirling-PDF is a self-hosted web application for PDF operations. The vulnerability stems from CWE-20 (improper input validation) in the file upload handling logic. Multiple upload endpoints use unsafe HTML rendering methods-specifically innerHTML or equivalent DOM manipulation-to display filenames without encoding or sanitizing user input. When a filename contains JavaScript payload (e.g., 'file<img src=x onerror=alert(1)>.pdf'), the browser interprets and executes the script in the security context of the web application. The affected product is identified via CPE cpe:2.3:a:stirling-tools:stirling-pdf:*:*:*:*:*:*:*:*, indicating all versions before 2.0.0 are vulnerable.

RemediationAI

Upgrade Stirling-PDF to version 2.0.0 or later, which fixes the unsafe filename rendering by implementing proper input sanitization and using safe DOM methods (textContent instead of innerHTML) or HTML entity encoding. If immediate upgrade is not feasible, restrict file upload access to trusted users only via authentication controls and network segmentation-deploy Stirling-PDF behind a reverse proxy that enforces authentication and limits upload access to specific IP ranges or user groups. Additionally, configure web server headers (Content-Security-Policy with script-src 'none' or 'self') to mitigate XSS impact, though this is not a substitute for patching. These controls reduce attack surface but do not eliminate the vulnerability; upgrade to 2.0.0 is the primary remediation. Consult the GitHub security advisory at https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-q5j3-4m5w-wp75 for vendor confirmation.