Stirling-PDF EUVD-2026-53355

The POST /api/v1/convert/url/pdf endpoint must be network-reachable by the attacker. The CVSS vector PR:N confirms no authentication is required against the endpoint itself; however, if the Stirling-PDF operator has enabled the application's optional authentication layer, an attacker would need valid credentials, which is a meaningful limiting factor not reflected in the NVD-submitted base score. The attacker must control a public-IP web server capable of serving HTML with embedded resource references - a low barrier. The SSRF payload reaches only resources the WeasyPrint process can access from the server's network context: cloud metadata services are reachable only on cloud-hosted instances, while internal network services depend on the deployment topology. Exploitation against on-premises instances without cloud metadata available is limited to internal network reconnaissance rather than credential theft. The initial URL IP-validation check does not restrict what IP addresses appear in embedded resource references within the fetched HTML, which is the precise bypass enabling the attack.

The CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) accurately reflects the attack posture: network-reachable, no authentication or interaction required, and scope-changing because the SSRF crosses trust boundaries into backend infrastructure systems. The changed scope (S:C) and high confidentiality impact (C:H) are consistent with cloud metadata exfiltration, where a single leaked IAM token can lead to full cloud account compromise - making real-world severity considerably higher than the base score alone suggests for cloud-hosted deployments. EPSS data is not present in the available intelligence, and no CISA KEV listing exists, so widespread automated exploitation has not been confirmed; however, the attack is trivially automatable (AC:L/PR:N/UI:N) and the SSRF payload is a well-understood technique requiring no novel research. The absence of a POC lowers immediate mass-exploitation risk but does not significantly alter the risk profile for targeted attacks against exposed instances. The gap between Stirling-PDF's partial SSRF protections and this unguarded endpoint indicates the flaw is architectural, not incidental, and likely reproducible by any attacker who reviews the source code. Deployments behind authentication middleware or network perimeters face materially lower risk than publicly exposed instances.

An attacker hosts a web page at a public IP containing an img tag whose src attribute points to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1). The attacker submits that public URL to the Stirling-PDF POST /api/v1/convert/url/pdf endpoint; Stirling-PDF validates the initial URL resolves to a public IP and passes the fetched HTML to WeasyPrint, which then performs a server-side GET against the metadata endpoint. The IAM credential response is embedded as rendered text or image alt-text fallback in the returned PDF, which the attacker downloads to obtain temporary cloud credentials. No public exploit code has been identified at time of analysis, but the attack is straightforward given WeasyPrint's well-documented resource-fetching behavior.