{"id":"CVE-2026-119343","kind":"vulnerability","aliases":["CVE-2026-119343"],"related":[],"title":"Stirling-PDF: unsanitized HTML-to-PDF endpoint lets requests read server files","description":"Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0.","summary":"Stirling-PDF's AI agent endpoint for creating PDFs from HTML passes user HTML to WeasyPrint without the sanitizer used elsewhere. An attacker can make the server fetch internal or cloud-metadata URLs and embed local files readable by the Stirling-PDF process into the generated PDF.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","stirling-pdf","weasyprint"],"not_affected_if":["login-enabled","no-network-exposure","version-3.0.0-or-later"],"how_to_check":"- Check the Stirling-PDF version; `unknown` if the deployment does not report it\n- Check whether `security.enableLogin` is set to `false` in the configuration\n- Check whether the server exposes `/api/v1/ai/tools/create-pdf-from-html-agent`","fix":"- Move to Stirling-PDF `3.0.0` or later","status":"open","published_at":"2026-10-30T21:16:53+00:00","first_seen_at":"2026-10-30T21:25:52+00:00","triaged_at":"2026-10-30T21:26:48+00:00","updated_at":"2026-10-30T21:26:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T21:26:48Z","model":"claude-haiku-5-5","output":{"fix":"- Move to Stirling-PDF `3.0.0` or later","reach":"network","title":"Stirling-PDF: unsanitized HTML-to-PDF endpoint lets requests read server files","impact":"medium","summary":"Stirling-PDF's AI agent endpoint for creating PDFs from HTML passes user HTML to WeasyPrint without the sanitizer used elsewhere. An attacker can make the server fetch internal or cloud-metadata URLs and embed local files readable by the Stirling-PDF process into the generated PDF.","audience":"businesses","category":"package","nicknames":[],"who_cares":["stirling-pdf","self-hosted","weasyprint"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Server files and internal network data end up readable inside generated PDFs","analyst_note":"","how_to_check":"- Check the Stirling-PDF version; `unknown` if the deployment does not report it\n- Check whether `security.enableLogin` is set to `false` in the configuration\n- Check whether the server exposes `/api/v1/ai/tools/create-pdf-from-html-agent`","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.0.0-or-later","login-enabled","no-network-exposure"],"who_is_affected":"Instances of Stirling-PDF before 3.0.0 that are reachable by others. The endpoint needs no credentials when login is disabled, so instances with `security.enableLogin` set to `false` are most exposed. Instances with login enabled require valid credentials first, and instances not reachable beyond a trusted network carry less risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4299,"output_tokens":608,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119343':17A,20A '-2026':16A,19A '/api/v1/ai/tools/create-pdf-from-html-agent':99C '/api/v1/convert/html/pdf':115C '3.0.0':97C,186C 'accept':100C 'agent':34B 'ai':33B 'applic':87C 'attack':52B,102C 'attacker-control':101C 'cloud':61B,133C 'cloud-metadata':60B,132C 'content':142C 'control':103C,116C 'convers':178C 'creat':37B 'credenti':159C 'customhtmlsanit':111C 'cve':15A,18A 'destin':135C 'distinct':168C 'earlier':170C 'elsewher':50B 'emb':65B,140C 'endpoint':9A,35B,155C 'facilit':89C 'fals':163C 'fetch':57B 'file':14A,67B,94C,137C 'fix':183C 'flaw':166C 'generat':77B,152C 'host':24B,85C 'html':6A,40B,43B 'html-to-pdf':5A 'htmlcontent':104C 'http':118C 'https':120C 'intern':58B,130C 'issu':181C 'let':10A 'local':66B,84C,141C 'make':54B,124C 'metadata':62B,134C 'older':177C 'oper':91C 'packag':21B 'pass':41B,106C 'path':117C,179C 'pdf':3A,8A,27B,31B,73B,78B,81C,93C,148C,153C,173C 'pdfs':38B 'post':98C 'prior':95C 'process':74B,149C 'reachabl':157C 'read':12A 'readabl':68B,143C 'refer':122C,138C 'request':11A,128C 'resourc':121C 'sanit':48B,114C 'security.enablelogin':161C 'self':23B 'self-host':22B 'server':13A,56B,126C 'server-sid':125C 'side':127C 'stirl':2A,26B,30B,72B,80C,147C,172C 'stirling-pdf':1A,25B,29B,71B,79C,146C,171C 'unlik':112C 'unsanit':4A 'url':63B 'use':49B 'user':42B 'various':90C 'version':185C 'vulner':175C 'weasyprint':28B,45B,109C,174C 'web':86C 'without':46B,110C,158C","nicknames":[],"mitigations":[],"who_affected":"Instances of Stirling-PDF before 3.0.0 that are reachable by others. The endpoint needs no credentials when login is disabled, so instances with `security.enableLogin` set to `false` are most exposed. Instances with login enabled require valid credentials first, and instances not reachable beyond a trusted network carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T21:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119343","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119343","severity":null,"published_at":"2026-10-30T21:16:53+00:00","modified_at":"2026-10-30T21:16:53+00:00","first_seen_at":"2026-10-30T21:25:52+00:00","fetched_at":"2026-10-30T21:25:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}