Stirling-PDF EUVD-2026-60364

Exploitation requires an active, authenticated ROLE_USER account on the target Stirling-PDF instance (CVSS PR:L confirms authentication is mandatory - unauthenticated exploitation is not possible). The /api/v1/pipeline/handleData endpoint must be reachable by the user, which is the default configuration for any Stirling-PDF deployment using the pipeline feature. The STIRLING-PDF-BACKEND-API-USER internal service account must have an API key provisioned, which is standard in pipeline-enabled deployments. Exploitation is strictly bounded to instances running versions prior to 2.9.0. Limiting factors include: the requirement for a valid user account (no anonymous exploitation), the self-hosted nature of Stirling-PDF (attacker must know or reach the specific instance URL), and the absence of external system compromise - impact is confined to the Stirling-PDF instance itself. Single-user deployments have no meaningful incremental risk since the escalating credential provides no access beyond what the sole operator already possesses.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N scores 8.5 and accurately reflects the attack profile: network-reachable, low complexity, requiring only a standard user account, with a scope change to the privileged internal service account context and high confidentiality impact from API key disclosure and sensitive endpoint access. The Scope:Changed designation is well-justified - a ROLE_USER credential escalates to the INTERNAL_API_USER tier, crossing a security boundary within the application. Real-world risk is context-dependent: in single-user or small-team deployments where all ROLE_USER accounts are trusted, the incremental risk is low since no external system compromise occurs. Multi-tenant or shared-instance deployments where ROLE_USER accounts belong to semi-trusted parties represent the genuine risk scenario. EPSS score is not available in the provided intelligence, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC have been identified, meaningfully reducing urgency compared to the raw CVSS score. The I:L component reflects rate-limit bypass and service account impersonation rather than direct data modification, which is a realistic but limited integrity concern. No availability impact is present.

An authenticated ROLE_USER on a shared Stirling-PDF instance submits a crafted pipeline request to /api/v1/pipeline/handleData, causing the server to inject the STIRLING-PDF-BACKEND-API-USER API key into the subrequest context; the attacker then calls /api/v1/user/get-api-key to retrieve that key. Using the recovered key, the attacker re-authenticates as the internal service account and queries /api/v1/info/requests/all to enumerate all other users' request histories and /api/v1/info/load/all for system telemetry, while also bypassing per-user rate limits for bulk PDF processing abuse. No public exploit code has been identified, but the attack requires only standard HTTP requests and knowledge of the documented API surface.