Stirling-PDF CVE-2026-41580

Exploitation requires two sequential conditions: first, the attacker must be able to submit a crafted PDF with JavaScript embedded in the Title or Author metadata fields to the Stirling-PDF instance (via the upload interface or API); second, a victim user must navigate to the /get-info-on-pdf endpoint to view that file's metadata. Per the CVSS PR:N metric, no authentication is required on the attacker's side to trigger the vulnerability, but user interaction (UI:R) from a victim is mandatory - the XSS fires only on active page view, not passively. The vulnerability is constrained to versions prior to 2.0.0. Single-user deployments have negligible exploitability since attacker and victim are the same principal. The attack surface grows substantially in multi-user or internet-exposed deployments where untrusted parties can upload files and authenticated users later review them.

The CVSS 6.1 Medium rating reflects AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - network-reachable, low complexity, no attacker authentication required, but user interaction is necessary. No EPSS data was provided in the intelligence, so exploitation probability from that signal is unknown. There is no CISA KEV listing and no public exploit code has been identified at time of analysis, making this a disclosed but not demonstrably weaponized issue. Real-world risk is context-dependent: for single-user, non-networked deployments the attacker and victim are the same person, yielding negligible impact; for multi-user or externally accessible deployments, any user with PDF upload access can target others. The Changed Scope metric elevates concern above typical reflected XSS because successful exploitation crosses the application trust boundary within the browser. The primary limiting factor is the required UI:R - a victim must actively navigate to the info endpoint for the payload to fire.

An attacker uploads a crafted PDF to a Stirling-PDF instance where the file's Title or Author metadata contains a JavaScript payload such as a cookie-stealing script. When a second user navigates to the /get-info-on-pdf endpoint to inspect that file, the unencoded metadata renders in their browser and the script executes within the Stirling-PDF application origin, exfiltrating session tokens or forging requests on the victim's behalf.