CVE-2026-119343 Details
Description
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0.
A vulnerability in Stirling-PDF versions prior to 3.0.0 allows for server-side request forgery (SSRF) and arbitrary local file reading through the WeasyPrint PDF generation engine. The issue arises in the 'create-pdf-from-html-agent' API endpoint, which is accessible without authentication when the 'security.enableLogin' setting is false. This endpoint processes client-supplied HTML content without proper sanitization, in contrast to the 'convert/html/pdf' endpoint, which applies necessary safeguards. As a result, WeasyPrint can be manipulated to fetch external resources or access local files, with the potential to extract embedded file data through the generated PDF.
Users can update to Stirling-PDF version 3.0.0 or later, where this vulnerability has been fixed. For versions prior to 3.0.0, it is recommended to disable the 'create-pdf-from-html-agent' endpoint or implement a custom HTML sanitizer before processing with WeasyPrint.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-3x7x-943g-269w | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Stirling-Tools/Stirling-PDF/commit/0570c4c4d9e7bf4786a02ab770ef75f116ac3719 | [email protected] | Source CodeVendor |
| https://github.com/Stirling-Tools/Stirling-PDF/pull/7018 | [email protected] | Source CodeVendor |
| https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v3.0.0 | [email protected] | Release NotesVendor |
| https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-3x7x-943g-269w | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-73 | External Control of File Name or Path | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Stirling-PDF | 2.14.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |