Live › vulnerability › CVE-2026-119342
Stirling-PDF versions 2.13.1 through 2.13.2 let a request to the SVG-to-PDF endpoint pull image files from the server's own disk into the returned PDF, because a root-relative image reference slips past the SVG sanitizer. An attacker can read PNG, JPG, GIF or SVG files the server can access, and can probe whether other image paths exist.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Teams that self-host Stirling-PDF 2.13.1 or 2.13.2 with the SVG-to-PDF conversion endpoint reachable. Exposure is highest on deployments with login disabled, since no account is needed; with login enabled, a non-admin user with access can still trigger it. Instances on other versions or without the endpoint exposed can skip it.
No product ranges from the sources yet.
2.13.1 through 2.13.2POST /api/v1/convert/svg/pdf2.13.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-119342")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.