Insufficient Session Timeout in Stirling-Tools Stirling-PDF Software
CVE-2026-129173

6.9MEDIUM

Key Information:

Vendor

Stirling-tools

Status
Stirling-PDF
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129173?

A security flaw has been identified in Stirling-Tools' Stirling-PDF, specifically affecting versions up to 3.3.0. The issue stems from the WorkflowParticipantController.getParticipantDetails function found in the WorkflowParticipantController.java file. This vulnerability allows attackers to manipulate the session timeout settings, leading to insufficient session timeout values that could be exploited remotely. Attempts to inform Stirling-Tools of this vulnerability were met with no response, increasing concerns regarding the safety of users relying on this software.

Affected Version(s)

Stirling-PDF 3.0

Stirling-PDF 3.1

Stirling-PDF 3.2

References

https://vuldb.com/vuln/437206
vdb-entrytechnical-description
https://vuldb.com/vuln/437206/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-129173
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vu Hoang Dat (VulDB User)
VulDB CNA Team
.