CVE-2026-113606 Details
Description
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.
An authorization bypass vulnerability has been identified in Stirling-PDF versions 3.0.0 through 3.2.0. This vulnerability allows authenticated users to access files stored by other users. The issue arises because the application does not properly restrict access to the server's storage directory. Attackers can exploit this by creating a processing folder that targets a victim's storage, listing their files, and using pipelines to read, modify, or delete those files.
The vulnerability can be remediated by scoping the implied storage root to 'basePath/{currentUserId}' for disk directories on multi-user servers. Additionally, the application should refuse access to 'storage/<otherId>' in the same way it currently rejects foreign file IDs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Stirling-PDF | >= 3.0.0, <= 3.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |