EUVD-2026-60320Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attacker supplies malicious PDF externally with no instance privileges; victim must click 'Get Info'; session data fully exposed but no availability impact and scope remains unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to access browser-session data or modify page content. This issue is fixed in version 2.0.0.
AnalysisAI
Stored cross-site scripting in Stirling-PDF prior to version 2.0.0 allows an attacker to embed JavaScript payloads inside PDF metadata fields (Title or Author) that execute in a victim's browser session when the user triggers the 'Get Info' workflow. The vulnerable template at get-info-on-pdf.html injects unsanitized metadata directly into the DOM via innerHTML, enabling session token theft and arbitrary page content manipulation against any user who processes a crafted PDF on a shared instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three specific conditions to align: the Stirling-PDF instance must be running a version prior to 2.0.0; the attacker must be able to introduce a crafted PDF (with a malicious payload in the Title or Author metadata) into the system, either by uploading it directly or by inducing a victim to upload it; and the victim must actively click 'Get Info' on that specific PDF file within the Stirling-PDF UI. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score is consistent with the mechanics: network delivery (AV:N), low complexity (AC:L), no attacker-side privileges required (PR:N), required victim interaction (UI:R), unchanged scope (S:U), and high confidentiality and integrity impact reflecting session compromise and DOM manipulation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: version 2.0.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all Stirling-PDF instances to identify current versions and determine which systems process untrusted PDFs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Stirling Pdf
View allStirling-PDF is a locally hosted web application that performs various operations on PDF files. Rated high severity (CVS
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Rated high severity (CVS
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Rated high
Server-side request forgery in Stirling-PDF's POST /api/v1/convert/url/pdf endpoint allows unauthenticated remote attack
Privilege escalation in Stirling-PDF before 2.9.0 allows any authenticated ROLE_USER to obtain the privileged STIRLING-P
Stirling-PDF, a locally hosted web application for PDF operations, contains a path traversal vulnerability in the /api/v
Stirling-PDF versions 2.1.5 through 2.5.1 are vulnerable to resource exhaustion denial of service through the watermark
A vulnerability was found in Stirling-Tools Stirling-PDF up to 0.28.3. Rated low severity (CVSS 2.3), this vulnerability
Stored cross-site scripting in Stirling-PDF's /get-info-on-pdf endpoint allows attacker-controlled JavaScript to execute
Stirling-PDF version 2.7.3 fails to sanitize HTML content from email bodies in the /api/v1/convert/eml/pdf endpoint when
Reflected cross-site scripting (XSS) in Stirling-PDF versions before 2.0.0 allows unauthenticated remote attackers to ex
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Rated high severity (CVS
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today