CVE-2026-41580: fallo de gravedad media en Stirling-Tools Stirling-PDF
Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.3%
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Stirling-Tools · Stirling-PDFCVEs relacionadas — Stirling-Tools Stirling-PDF
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-85714CRITICALStirling-PDF: Remote Code Execution via H2EPSS 3.4%CVE-2025-55161HIGHStirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdfEPSS 2.2%CVE-2025-55150HIGHStirling-PDF SSRF vulnerability on /api/v1/convert/html/pdfEPSS 1.8%CVE-2026-113605HIGHStirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-databaseEPSS 0.7%CVE-2024-52286LOWSelf Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDFEPSS 0.5%CVE-2025-46568HIGHStirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read VulnerabilityEPSS 0.5%