CVE-2025-55161: high-severity vulnerability in Stirling-Tools Stirling-PDF
Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
58Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8.6epss 2.2%
from disclosure to weapon
Published on NVDAug 11
VulnCheck+57d
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected products
Stirling-Tools · Stirling-PDFRelated CVEs — Stirling-Tools Stirling-PDF
In the same product, most dangerous first.
CVE-2026-85714CRITICALStirling-PDF: Remote Code Execution via H2EPSS 3.4%CVE-2025-55150HIGHStirling-PDF SSRF vulnerability on /api/v1/convert/html/pdfEPSS 1.8%CVE-2026-113605HIGHStirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-databaseEPSS 0.7%CVE-2024-52286LOWSelf Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDFEPSS 0.5%CVE-2025-46568HIGHStirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read VulnerabilityEPSS 0.5%CVE-2026-27625HIGHStirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP ExtractionEPSS 0.5%