Reflected XSS Vulnerability in Stirling-PDF Web Application

CVE-2026-33436

What is CVE-2026-33436?

Stirling-PDF, a web application for managing PDF files, is vulnerable to reflected XSS attacks in versions prior to 2.0.0. The file upload functionality fails to properly sanitize user-supplied filenames, allowing an attacker to inject malicious JavaScript code. This code is executed in the browser context of users who upload such files, leading to potential data theft or session hijacking. Protecting against this vulnerability requires upgrading to version 2.0.0, which addresses the file upload security flaws by implementing proper sanitization methods.

References