Vendor

    Stirling-Tools

    20 known vulnerabilities in products by Stirling-Tools, 0 of them actively exploited (CISA KEV).

    Key figures

    20

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Stirling-Tools
    CriticalCVE-2026-85714

    Stirling-PDF: Remote Code Execution via H2

    		9.1
    CriticalCVE-2025-55161

    Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf

    also in 1 other product

    		8.6
    CriticalCVE-2025-55150

    Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf

    also in 1 other product

    		8.6
    HighCVE-2026-113605

    Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database

    		7.2
    HighCVE-2026-57485

    Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

    		8.5
    HighCVE-2026-71270

    Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess

    		8.6
    HighCVE-2026-113606

    Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders

    		7.1
    HighCVE-2026-33437

    Stirling PDF: Stored XSS in Info Summary

    		8.1
    HighCVE-2026-27625

    Stirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP Extraction

    also in 1 other product

    		8.1
    MediumCVE-2026-119342

    Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass

    		5.3
    MediumCVE-2026-119343

    Stirling-Tools Stirling-PDF: External Control of File Name or Path

    		6.8
    MediumCVE-2026-129173

    Stirling-Tools Stirling-PDF: security vulnerability

    		5.3
    CriticalCVE-2025-55151

    Stirling-PDF SSRF vulnerability on /api/v1/convert/file/pdf

    also in 1 other product

    		8.6
    HighCVE-2025-46568

    Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability

    also in 1 other product

    		7.5
    MediumCVE-2026-33438

    Stirling-PDF vulnerable to DoS via add-watermark

    also in 1 other product

    		6.5
    MediumCVE-2026-41580

    Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)

    also in 1 other product

    		6.1
    MediumCVE-2026-34071

    Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export

    also in 1 other product

    		5.4
    LowCVE-2024-52286

    Self Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDF

    		—
    MediumCVE-2026-33436

    Stirling-PDF: Reflected XSS through crafted filename in file upload functionality

    also in 1 other product

    		3.1
    MediumCVE-2024-9075

    Stirling-Tools Stirling-PDF Markdown-to-PDF cross site scripting

    also in 1 other product

    		2.6

    Products

    Products by Stirling-Tools
    Stirling-Tools Stirling-PDF200