CVE-2026-33436

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render user-supplied filenames directly into HTML using unsafe methods like innerHTML without sanitization. An attacker can craft a file with a malicious filename containing JavaScript that executes in the uploading user's browser context, resulting in reflected XSS. The issue affects numerous upload endpoints across the application. The issue has been fixed in version 2.0.0.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-q5j3-4m5w-wp75	Exploit Vendor Advisory
https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-q5j3-4m5w-wp75	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:stirlingpdf:stirling_pdf:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Stirling-PDF es una aplicación web alojada localmente que facilita varias operaciones en archivos PDF. En versiones anteriores a la 2.0.0, los puntos finales de carga de archivos renderizan los nombres de archivo proporcionados por el usuario directamente en HTML utilizando métodos inseguros como innerHTML sin sanitización. Un atacante puede crear un archivo con un nombre de archivo malicioso que contiene JavaScript que se ejecuta en el contexto del navegador del usuario que realiza la carga, lo que resulta en XSS reflejado. El problema afecta a numerosos puntos finales de carga en toda la aplicación. El problema ha sido solucionado en la versión 2.0.0.

Information

Published : 2026-04-17 21:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-33436

Mitre link : CVE-2026-33436

CVE.ORG link : CVE-2026-33436

JSON object : View

Products Affected

stirlingpdf

stirling_pdf

CWE

CWE-20

Improper Input Validation

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2026-33436", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33436", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T16:20:12.422033Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Stirling-Tools", "product": "Stirling-PDF", "versions": [{"status": "affected", "version": "< 2.0.0"}]}]}], "published": "2026-04-17T21:16:32.750", "references": [{"url": "https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-q5j3-4m5w-wp75", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-q5j3-4m5w-wp75", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render user-supplied filenames directly into HTML using unsafe methods like innerHTML without sanitization. An attacker can craft a file with a malicious filename containing JavaScript that executes in the uploading user's browser context, resulting in reflected XSS. The issue affects numerous upload endpoints across the application. The issue has been fixed in version 2.0.0."}, {"lang": "es", "value": "Stirling-PDF es una aplicaci\u00f3n web alojada localmente que facilita varias operaciones en archivos PDF. En versiones anteriores a la 2.0.0, los puntos finales de carga de archivos renderizan los nombres de archivo proporcionados por el usuario directamente en HTML utilizando m\u00e9todos inseguros como innerHTML sin sanitizaci\u00f3n. Un atacante puede crear un archivo con un nombre de archivo malicioso que contiene JavaScript que se ejecuta en el contexto del navegador del usuario que realiza la carga, lo que resulta en XSS reflejado. El problema afecta a numerosos puntos finales de carga en toda la aplicaci\u00f3n. El problema ha sido solucionado en la versi\u00f3n 2.0.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:stirlingpdf:stirling_pdf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "314AE048-8BB8-4A18-BF15-5CF9C8F3808C", "versionEndExcluding": "2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}