Stored Cross-Site Scripting Vulnerability in Stirling-PDF Web Application
CVE-2026-33437

8.1HIGH

Key Information:

Vendor

Stirling-tools

Status
Stirling-PDF
Vendor
CVE Published:
17 August 2026

What is CVE-2026-33437?

The Stirling-PDF web application contained a vulnerability that allowed untrusted PDF Title and Author metadata to be inserted into the web application interface. This flaw existed prior to version 2.0.0, where, upon invoking the Get Info workflow, the application inadequately handled this metadata, resulting in the potential execution of malicious scripts. Attackers could exploit this vulnerability to carry out stored cross-site scripting attacks, compromising the security of user browser sessions and altering page content. Users are highly encouraged to update to version 2.0.0 or later to mitigate this risk.

Affected Version(s)

Stirling-PDF < 2.0.0

References

https://github.com/Stirling-Tools/Stirling-PDF/security/a...
x_refsource_CONFIRM
https://github.com/Stirling-Tools/Stirling-PDF/releases/t...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.