What is the CVSS score of CVE-2026-41580?

CVE-2026-41580 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-41580?

Yes, a patch is available for CVE-2026-41580. Update the affected software to the latest version immediately.

Stirling-PDF CVE-2026-41580

EUVD-2026-44691 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-15 GitHub_M

XSS Stirling Pdf Stirling Tools

6.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-reachable endpoint, no attacker auth required per description, but victim must actively view the info page (UI:R); scope changes because injected script executes in the application's browser origin with limited C/I impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Source Code Evidence Fetched

Jul 15, 2026 - 15:46 vuln.today

Analysis Generated

Jul 15, 2026 - 15:46 vuln.today

DescriptionCVE.org

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0.

AnalysisAI

Stored cross-site scripting in Stirling-PDF's /get-info-on-pdf endpoint allows attacker-controlled JavaScript to execute in any user's browser when they view metadata of a crafted PDF file. All versions prior to 2.0.0 are affected; the CVSS scope change (S:C) indicates injected scripts operate within the application's browser origin, enabling session hijacking or unauthorized actions. No public exploit code has been identified at time of analysis and this vulnerability has not been listed in CISA KEV.

Technical ContextAI

Stirling-PDF is a self-hosted, open-source web application for PDF manipulation (CPE: cpe:2.3:a:stirling-tools:stirling-pdf:*:*:*:*:*:*:*:*). The /get-info-on-pdf endpoint extracts and renders PDF document metadata - specifically the Title and Author fields - directly into the HTML response. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): metadata values are reflected without HTML encoding or sanitization, so any JavaScript embedded in those fields executes when a browser renders the page. The CVSS S:C (Scope Changed) metric confirms the injected script runs in the Stirling-PDF web origin's context, where it can access cookies, local storage, and perform authenticated API calls on behalf of the victim.

RemediationAI

Upgrade to Stirling-PDF version 2.0.0, which resolves this issue per the GitHub security advisory GHSA-rjjx-43g5-mp76 (https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-rjjx-43g5-mp76). Note that v2.0.0 is a major release with a redesigned UI, new licensing model, and significant configuration changes; the maintainers explicitly recommend backing up the config directory before upgrading production deployments. If immediate upgrade is not feasible, restrict access to the /get-info-on-pdf endpoint via reverse-proxy ACLs or WAF rules - this prevents the payload from being rendered, but disables PDF metadata inspection for all users. Additionally, limiting upload permissions to trusted users reduces the attacker's ability to plant a malicious PDF, though this is a partial control and not a substitute for patching.