Local File Inclusion Vulnerability in Stirling-PDF by Stirling Tools

CVE-2026-119342

What is CVE-2026-119342?

Stirling-PDF, a web application for managing PDF files, is susceptible to a local file inclusion vulnerability affecting versions 2.13.1 and 2.13.2. An attacker can exploit the '/api/v1/convert/svg/pdf' endpoint by providing crafted SVG content, which circumvents the SvgSanitizer.isExternalUrl() check. This flaw allows the unauthorized rendering of image-decodable server files into returned PDFs, exposing PNG, JPG, GIF, or SVG images depending on the configuration. Such an attack can occur even on login-disabled deployments or with non-admin access when logins are enabled. While the vulnerability does not disclose plain text, binary files, or external entities, it does pose a serious threat by revealing image files that should remain protected. The issue has been addressed in version 2.13.2.

References