Server-Side Request Forgery in Stirling-PDF by Stirling Tools

CVE-2026-71270

What is CVE-2026-71270?

The Stirling-PDF tool has a vulnerability in its POST /api/v1/convert/url/pdf endpoint that neglects to implement crucial SSRF protections. Unlike other conversion endpoints that utilize a CustomHtmlSanitizer/SsrfProtectionService, this endpoint merely checks if the requested URL resolves to a public IP. This oversight permits an attacker to craft malicious HTML that can lead to unauthorized access to sensitive internal information through resource references. During the conversion process, embedded elements like images may access unsecured cloud metadata endpoints without necessary filtering. This vulnerability poses a significant risk as it allows adversaries to exploit the server's capabilities to leak sensitive data into the generated PDFs.

References