{"id":"CVE-2026-113606","kind":"vulnerability","aliases":["CVE-2026-113606"],"related":[],"title":"Stirling-PDF: authenticated users read and destroy other users' stored files","description":"Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.","summary":"Stirling-PDF 3.0.0 through 3.2.0 lets any logged-in user point a processing folder at the server storage directory of another user. An attacker can then list, read, modify or delete that victim's files through the processing pipeline.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","multi-user","package","self-hosted","stirling-pdf"],"not_affected_if":["patched-version","single-user-instance"],"how_to_check":"- Check the installed Stirling-PDF version against `3.0.0` through `3.2.0`\n- Review whether POST /api/v1/processing-folders is reachable by ordinary user accounts\n- Look for unexpected processing folders pointing into the storage directory, if the sources do not say more: unknown","fix":"- Upgrade Stirling-PDF to a version later than `3.2.0`; the fixed version is unknown from the sources\n- Until patched, restrict access to user accounts that you trust\n- Rotate credentials for affected users if their files may have been accessed: unknown","status":"open","published_at":"2026-10-20T16:17:10+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:34:41+00:00","updated_at":"2026-10-25T03:34:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:34:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Stirling-PDF to a version later than `3.2.0`; the fixed version is unknown from the sources\n- Until patched, restrict access to user accounts that you trust\n- Rotate credentials for affected users if their files may have been accessed: unknown","reach":"network","title":"Stirling-PDF: authenticated users read and destroy other users' stored files","impact":"high","summary":"Stirling-PDF 3.0.0 through 3.2.0 lets any logged-in user point a processing folder at the server storage directory of another user. An attacker can then list, read, modify or delete that victim's files through the processing pipeline.","category":"package","nicknames":[],"who_cares":["self-hosted","stirling-pdf","java","multi-user"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads, modifies or deletes other users' stored files","analyst_note":"Confirm the fixed version and whether processing-folder creation is restricted by default; source URL https://nvd.nist.gov/vuln/detail/CVE-2026-113606 has only the description.","how_to_check":"- Check the installed Stirling-PDF version against `3.0.0` through `3.2.0`\n- Review whether POST /api/v1/processing-folders is reachable by ordinary user accounts\n- Look for unexpected processing folders pointing into the storage directory, if the sources do not say more: unknown","needs_analyst":true,"not_affected_if":["single-user-instance","patched-version"],"who_is_affected":"Teams that self-host Stirling-PDF in the affected version range and allow more than one user account on the same instance. Exposure depends on users being able to create processing folders, which the sources describe as available to any authenticated user. Single-user deployments or instances on a patched version can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":3357,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113606':15A,18A '-2026':14A,17A '/api/v1/processing-folders':109C '3.0.0':33B,74C '3.2.0':35B,76C 'access':87C 'allow':83C 'anoth':52B 'attack':55B,102C 'authent':4A,84C 'author':79C 'bypass':80C 'contain':77C 'creat':104C 'cve':13A,16A 'delet':62B 'destroy':8A,121C 'directori':50B,101C 'file':12A,66B,91C,113C,123C 'folder':45B,96C,106C 'host':26B 'java':19B 'let':36B 'list':58B,112C 'log':39B 'logged-in':38B 'modifi':60B,119C 'multi':21B 'multi-us':20B 'packag':23B 'pdf':3A,29B,32B,73C 'pipelin':70B,116C 'point':42B,93C 'post':108C 'process':44B,69B,95C 'read':6A,59B,118C 'run':115C 'self':25B 'self-host':24B 'server':48B,99C 'stirl':2A,28B,31B,72C 'stirling-pdf':1A,27B,30B,71C 'storag':49B,100C,111C 'store':11A,90C 'target':110C 'user':5A,10A,22B,41B,53B,85C,89C 'via':107C 'victim':64B,122C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Stirling-PDF in the affected version range and allow more than one user account on the same instance. Exposure depends on users being able to create processing folders, which the sources describe as available to any authenticated user. Single-user deployments or instances on a patched version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113606","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113606","severity":null,"published_at":"2026-10-20T16:17:10+00:00","modified_at":"2026-10-23T02:16:55+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}