CVE-2026-129173 · Package
NO FIX YET
Stirling-PDF up to 3.3.0 has a flaw in its workflow participant details endpoint where the session timeout is too long. An attacker who gets hold of a session may be able to keep using it longer than intended.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Stirling-PDF up to version 3.3.0 with the proprietary workflow module exposed to users. The flaw sits in the participant details endpoint, so deployments without that workflow feature are less likely to be exposed. The sources do not say whether a fix exists.
Not affected if default-config
Who cares java, self-hosted, stirling-pdf
3.3.0 are listed as affected.No fix yet, per the sources.
A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.0. Affected is the function WorkflowParticipantController.getParticipantDetails of the file app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/WorkflowParticipantController.java of the component Participant Details Endpoint. Performing a manipulation results in insufficient session timeout value. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.