CVE-2026-119342

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2.

• CWE-20
• CWE-22
• CWE-610
• CWE-918

• https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5
• https://github.com/Stirling-Tools/Stirling-PDF/pull/6796
• https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2
• https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-pr4g-9qp2-g8j8

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119337RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…7.1
• CVE-2026-119338Tesseract is an open source OCR engine. From 5.4.0 until 5.5…6.9
• CVE-2026-119339Tesseract is an open source OCR engine. Prior to 5.5.4, Weig…5.5
• CVE-2026-11934IBM Verify Identity Access could allow an administrator to e…7.2
• CVE-2026-119340Tesseract is an open source OCR engine. Prior to 5.5.4, GENE…5.5
• CVE-2026-119341Tesseract is an open source OCR engine. Prior to 5.5.4, Read…0
• CVE-2026-119343Stirling-PDF is a locally hosted web application that facili…6.8
• CVE-2026-11936IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…5.4
• CVE-2026-119364ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 conta…5.3
• CVE-2026-119365Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-119367Missing Authorization vulnerability in Liquid Web / StellarW…5.4
• CVE-2026-119368Missing Authorization vulnerability in Liquid Web / StellarW…5.3