What is the CVSS score of CVE-2026-34071?

CVE-2026-34071 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Stirling Pdf are affected by CVE-2026-34071?

Organizations using Stirling-PDF should be aware of moderate risk from CVE-2026-34071, a cross-site scripting vulnerability rated CVSS 5.4.

How to fix or mitigate CVE-2026-34071?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Stirling Pdf CVE-2026-34071

EUVD-2026-16271 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-26 GitHub_M

XSS Stirling Pdf Stirling Tools

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 17:15 euvd

EUVD-2026-16271

Analysis Generated

Mar 26, 2026 - 17:15 vuln.today

CVE Published

Mar 26, 2026 - 17:00 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version 2.7.3, the /api/v1/convert/eml/pdf endpoint with parameter downloadHtml=true returns unsanitized HTML from the email body with Content-Type: text/html. An attacker who sends a malicious email to a Stirling-PDF user can achieve JavaScript execution when that user exports the email using the "Download HTML intermediate file" feature. Version 2.8.0 fixes the issue.

AnalysisAI

Stirling-PDF version 2.7.3 fails to sanitize HTML content from email bodies in the /api/v1/convert/eml/pdf endpoint when the downloadHtml=true parameter is set, allowing unauthenticated remote attackers to inject and execute arbitrary JavaScript code. An attacker can craft a malicious email that, when processed by a Stirling-PDF user through the 'Download HTML intermediate file' feature, executes JavaScript in the user's browser context with access to local data and session tokens. Proof-of-concept code has been demonstrated, and the vendor released version 2.8.0 to address the vulnerability.

Technical ContextAI

Stirling-PDF is a locally hosted web application (cpe:2.3:a:stirling-tools:stirling-pdf) that processes PDF and email file formats. The vulnerability exists in the email-to-PDF conversion endpoint (/api/v1/convert/eml/pdf) which accepts HTML content from email message bodies and returns it with Content-Type: text/html without proper HTML sanitization or encoding. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting or XSS). When an attacker-controlled email is processed with the downloadHtml parameter enabled, the application streams unsanitized HTML directly to the user's browser, allowing embedded script tags or event handlers within the email body to execute in the security context of the Stirling-PDF domain.

RemediationAI

Upgrade Stirling-PDF to version 2.8.0 or later to obtain the patched version. Until upgrade is feasible, restrict access to the /api/v1/convert/eml/pdf endpoint to trusted internal users only, disable or restrict the downloadHtml parameter if possible through application configuration, and avoid processing emails from untrusted sources through the HTML export feature. Implement a reverse proxy with Content-Security-Policy (CSP) headers to block inline script execution and restrict script sources. Network-level controls should limit Stirling-PDF access to authorized users only. See the vendor advisory at https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-xmhg-fv84-jgfc for detailed patch information.