---
id: "CVE-2026-119343"
kind: "vulnerability"
aliases: ["CVE-2026-119343"]
title: "Stirling-PDF: unsanitized HTML-to-PDF endpoint lets requests read server files"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "stirling-pdf", "weasyprint"]
not_affected_if: ["login-enabled", "no-network-exposure", "version-3.0.0-or-later"]
published_at: "2026-10-30T21:16:53+00:00"
first_seen_at: "2026-10-30T21:25:52+00:00"
updated_at: "2026-10-30T21:26:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119343", "first_seen_at": "2026-10-30T21:25:52+00:00"}]
---

# Stirling-PDF: unsanitized HTML-to-PDF endpoint lets requests read server files

Stirling-PDF's AI agent endpoint for creating PDFs from HTML passes user HTML to WeasyPrint without the sanitizer used elsewhere. An attacker can make the server fetch internal or cloud-metadata URLs and embed local files readable by the Stirling-PDF process into the generated PDF.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Stirling-PDF version; `unknown` if the deployment does not report it
- Check whether `security.enableLogin` is set to `false` in the configuration
- Check whether the server exposes `/api/v1/ai/tools/create-pdf-from-html-agent`

## Fix

- Move to Stirling-PDF `3.0.0` or later

## Timeline

- 2026-10-30T21:25:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119343

## From the sources

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_