Stirling-PDF EUVD-2026-114456

Requires that the Stirling-PDF SVG-to-PDF converter (POST /api/v1/convert/svg/pdf) be reachable; it is exploitable in the DEFAULT configuration (disableSanitize=false) and needs no admin role. It is fully unauthenticated only on login-disabled deployments; when login is enabled, any non-admin authenticated user can trigger it (the controller has no @PreAuthorize role check). The attacker must supply an SVG whose image href is in scheme-less root-relative form (e.g. /C:/path/file.svg) - explicit file: URLs, bare C: paths, backslash paths, and HTTP references are all stripped or fail. Key limiting factors that cap real impact: the targeted file must be image-decodable (PNG/JPG/GIF/SVG) - text, binary, directories, XInclude text, and XXE do not leak; the attacker must be able to name/guess the target path; and the existence oracle only distinguishes decodable images (all other cases return an indistinguishable HTTP 500).

This is a genuine but bounded information-disclosure flaw, not a high-urgency emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) is internally consistent with the GHSA advisory: network-reachable, low-complexity, no authentication required on login-disabled deployments, with only limited confidentiality impact and no integrity or availability effect. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with a medium-severity read-only bug. No EPSS score and no KEV listing were provided in the input, so there is no signal of active exploitation or high predicted exploitation probability - treat exploitation likelihood as unmeasured rather than low. A detailed PoC was reproduced end-to-end by the reporter in the GHSA advisory, but the input does not mark it as confirmed working exploit code, so it should be counted as a public PoC reference, not a packaged weapon. No SSVC decision string was supplied. The practical risk is tempered by real constraints the advisory verified: only image-decodable files (PNG/JPG/GIF/SVG) can be exfiltrated, plain text/binary/XXE/explicit-file-URL/HTTP vectors are all fail-closed, and the existence oracle only resolves decodable images. Net: a legitimate confidentiality issue worth patching this cycle, but materially lower real-world risk than the network-unauthenticated CVSS framing alone might suggest.

An attacker (unauthenticated on a login-disabled Stirling-PDF instance, or any non-admin user when login is enabled) submits a crafted SVG to POST /api/v1/convert/svg/pdf whose image xlink:href is a scheme-less, root-relative path such as /C:/Users/.../signature.png pointing at a sensitive image on the server. Because the path bypasses both SvgSanitizer.isExternalUrl() and Batik's same-origin check (document base is hard-coded to file:///input.svg), Batik loads and renders that server-side file into the PDF returned to the attacker. A reproduced PoC exists in the GHSA advisory; the low attack complexity and no-UI/no-auth path make it directly scriptable and, with CSRF globally disabled, browser-triggerable.