Local File Inclusion Vulnerability in Stirling-PDF by Stirling Tools
CVE-2026-119343

6.8MEDIUM

Key Information:

Vendor

Stirling-tools

Status
Stirling-PDF
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119343?

Stirling-PDF, a locally hosted web application designed for PDF file operations, is vulnerable to a local file inclusion issue prior to version 3.0.0. The vulnerability is present in the POST /api/v1/ai/tools/create-pdf-from-html-agent endpoint, where attacker-controlled 'htmlContent' is accepted without proper sanitization via CustomHtmlSanitizer. This allows the potential for server-side requests to internal or cloud-based resources, as well as embedding local content into generated PDFs that the Stirling-PDF process can read. Additionally, if security.enableLogin is set to false, this endpoint is accessible without authentication. This vulnerability is distinct from previous issues within Stirling-PDF's older conversion paths and has been addressed in version 3.0.0.

Affected Version(s)

Stirling-PDF < 3.0.0

References

https://github.com/Stirling-Tools/Stirling-PDF/security/a...
x_refsource_CONFIRM
https://github.com/Stirling-Tools/Stirling-PDF/pull/7018
x_refsource_MISC
https://github.com/Stirling-Tools/Stirling-PDF/commit/057...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.