EUVD-2026-105084
GHSA-c89m-ff4c-f99w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryCreate processing folder via POST /api/v1/processing-folders targeting storage/<victimUserId>
-
ExploitEnumerate and list victim's stored files
-
ExecutionRun pipeline to read/modify/delete files
-
ImpactBreach or destroy victim data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated account (PR:L) on a multi-user or multi-tenant Stirling-PDF instance running the proprietary processing-folder code present in versions 3.0.0 through 3.2.0 (FolderAccessGuard / ProcessingFolderController). The attacker must know or enumerate a victim's userId to construct the storage/<victimUserId> target path. Exploitation is limited by: needing authentication (not anonymous), a deployment hosting more than one user's files, and knowledge of victim user identifiers; single-user/standalone instances have no cross-tenant victim to target. No special victim interaction or non-default feature toggle is required beyond normal processing-folder functionality. |
| Impact | This is a credible, actionable priority for any multi-user Stirling-PDF deployment rather than a paper-high CVSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account and no user interaction - a realistic bar on any instance with self-registration or multiple tenants. A public exploit exists (VulnCheck-published PoC at github.com/abraxas/stirling-storage-folder-idor), materially lowering the skill required and raising near-term risk. No EPSS score and no KEV status were provided, so there is no evidence of mass automated exploitation yet; the signal is 'public exploit code exists' (POC) which is distinct from confirmed in-the-wild use. The vendor-supplied 4.0 vector scores impact as VC:L/VI:H/VA:N, but the description explicitly states attackers can 'read, modify, or destroy' victims' files - reading sensitive documents, tampering, and destruction argue for higher confidentiality and availability impact than VC:L/VA:N capture; this divergence is noted and reflected in my independent assessment below. Net: a low-privilege authenticated IDOR with a working PoC against a popular self-hosted product - patch promptly on any shared/multi-tenant instance. |
| Exploit ScenarioDerived | A registered (low-privilege) user on a shared or multi-tenant Stirling-PDF instance calls POST /api/v1/processing-folders with a path targeting storage/<victimUserId>, then lists and runs pipelines against another user's stored PDFs to exfiltrate, alter, or delete them. Because AV:N/AC:L/PR:L/UI:N, this needs only a valid account and no victim interaction, and a public VulnCheck PoC already automates the folder-pointing step. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Authenticated users on multi-user Stirling-PDF 3.0.0 through 3.2.0 can reach other tenants' stored documents by creating a processing folder whose path points into the server's storage directory at storage/<victimUserId>, then listing and running pipelines against that folder to read, alter, or delete the victim's files. The flaw is an authorization bypass through a user-controlled key (CWE-639) exposed by the proprietary processing-folder API (POST /api/v1/processing-folders) and the FolderAccessGuard check shipped in those releases. Publicly available exploit code exists, published alongside a technical write-up and a proof-of-concept repository, so the barrier to reproduction is low for anyone holding a valid account on an instance that hosts more than one user's files; EPSS scoring was not supplied in the available intelligence. The supplied CVSS 4.0 vector rates it 7.1 with PR:L, while our independent CVSS 3.1 assessment scores it 8.8 (C:H/I:H/A:H), and neither rating reflects anonymous exploitation - the practical exposure is a multi-tenant deployment risk rather than an internet-wide mass-exploitation event.
RemediationAI
No vendor-released patch or fixed version was identified in the provided intelligence at time of analysis, so the immediate action is to eliminate the cross-tenant path itself: on any Stirling-PDF 3.0.0-3.2.0 instance serving more than one user, disable the proprietary processing-folder feature (or run only the community edition without that module) until a fixed release is confirmed against the vendor advisory at https://www.vulncheck.com/advisories/stirling-pdf-3.0.0-through-3.2.0-authorization-bypass-via-processing-folders - the trade-off is loss of batch/pipeline automation for all users, including legitimate ones. If pipelines must stay online, harden the container boundary instead: mount the per-user storage directory read-only or on a filesystem the application user cannot traverse into sibling userId directories, and run each tenant in its own instance or container so storage/<victimUserId> is unreachable across accounts; this preserves functionality but costs per-tenant infrastructure and complicates shared-file workflows. As a detection and containment measure, log and alert on POST /api/v1/processing-folders requests whose folder path contains 'storage/' or another user's identifier, and audit pipeline runs for file paths outside the caller's own prefix - this does not stop exploitation but gives early warning and forensic coverage. Restrict access to the Stirling-PDF web UI and API to trusted networks or an authenticating reverse proxy, since the attack still requires a valid account (PR:L); this reduces the attacker pool but does not fix the underlying authorization defect. Track the upstream repository and the researcher write-ups at https://abraxaslabs.tech/research/stirling-storage-folder-idor for the release that introduces a server-side ownership check, and note that public exploit code exists (https://github.com/abraxas/stirling-storage-folder-idor), so prioritise multi-tenant deployments for immediate mitigation rather than waiting for a patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Stirling-PDF's proprietary module implements user-managed 'processing folders' - server-side directories that pipelines of PDF operations run against. In versions 3.0.0 through 3.2.0 the FolderAccessGuard (app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java) and ProcessingFolderController (…/policy/controller/ProcessingFolderController.java) fail to bind the requested folder to the requesting principal, so the userId embedded in the target path is attacker-controlled. The classic CWE-639 pattern applies: authorization is decided on a user-supplied identifier rather than on a server-side lookup of resources owned by the authenticated session. Because the same subsystem exposes both directory listing and pipeline execution, a single successful bypass escalates from information disclosure into destructive capability - an attacker can enumerate files, download them through processing operations, overwrite them, or delete them. The public CPE record cpe:2.3:a:stirling-tools:stirling-pdf:*:*:*:*:*:*:*:* uses a wildcard version, so it does not constrain the affected range on its own; version scoping must be taken from the vendor advisory and the upstream source tags for v3.2.0 rather than from the CPE string. Functionally the vulnerable code path requires only the standard processing-folder feature enabled with an authenticated session; no administrative privilege, victim interaction, or unusual configuration is needed, but a single-user instance has no cross-tenant victim whose files could be reached.
Know when Stirling Pdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Low-privilege authenticated user remotely reaches the API (AV:N/AC:L/PR:L/UI:N) and can read, modify, and destroy other users' files, giving high C/I/A; no cross-component scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.
Technical POC Analysis
CWE-639 (Authorization Bypass Through User-Controlled Key), with CWE-73 (external control of file path) as the enabler.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Stirling-PDF versions 3.0.0 through 3.2.0 contain an authorization flaw that lets any authenticated user on a shared instance reach into other tenants' stored document folders, reading, altering, or deleting files they should never see. Because a valid low-privilege account is the only prerequisite and publicly available exploit code exists, any multi-user deployment of these releases should be treated as a cross-tenant data exposure risk affecting every customer or department whose documents reside on the same instance, with direct confidentiality, integrity, and regulatory-notification implications.
No vendor-released patch identified at time of analysis; interim mitigations include disabling or blocking the processing-folder API, running affected instances in single-tenant mode, enforcing per-tenant storage segmentation with OS-level permissions, restricting account creation to trusted users, and monitoring for folder paths that reference other users' storage directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Stirling Pdf
View allStirling-PDF is a locally hosted web application that performs various operations on PDF files. Rated high severity (CVS
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Rated high severity (CVS
Stirling-PDF 2.13.2 through 3.2.0 lets an authenticated administrator regain Java method execution by uploading a crafte
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Rated high
Server-side request forgery in Stirling-PDF's POST /api/v1/convert/url/pdf endpoint allows unauthenticated remote attack
Privilege escalation in Stirling-PDF before 2.9.0 allows any authenticated ROLE_USER to obtain the privileged STIRLING-P
Stored cross-site scripting in Stirling-PDF prior to version 2.0.0 allows an attacker to embed JavaScript payloads insid
Stirling-PDF, a locally hosted web application for PDF operations, contains a path traversal vulnerability in the /api/v
Stirling-PDF versions 2.1.5 through 2.5.1 are vulnerable to resource exhaustion denial of service through the watermark
A vulnerability was found in Stirling-Tools Stirling-PDF up to 0.28.3. Rated low severity (CVSS 2.3), this vulnerability
Stored cross-site scripting in Stirling-PDF's /get-info-on-pdf endpoint allows attacker-controlled JavaScript to execute
Stirling-PDF version 2.7.3 fails to sanitize HTML content from email bodies in the /api/v1/convert/eml/pdf endpoint when
Exploit-DB