CVE-2026-27625: Stirling-PDF Path Traversal Vulnerability

CVE-2026-27625 Overview

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. A path traversal vulnerability exists in versions prior to 2.5.2 that allows authenticated users to write arbitrary files outside the intended temporary working directory. The /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZIP entries without proper path validation, enabling attackers to overwrite files with the privileges of the Stirling-PDF process user (stirlingpdfuser).

Critical Impact

Authenticated attackers can exploit this vulnerability to achieve arbitrary file write on the system, potentially compromising data integrity, overwriting configuration files, or achieving further system compromise depending on writable paths accessible to the application process.

Affected Products

• Stirling-PDF versions prior to 2.5.2
• Self-hosted Stirling-PDF deployments using the vulnerable endpoint
• Docker and bare-metal installations running affected versions

Discovery Timeline

• 2026-03-20 - CVE-2026-27625 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-27625

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The core issue stems from insufficient validation of file paths extracted from user-supplied ZIP archives during the Markdown to PDF conversion process.

When a user submits a ZIP file to the /api/v1/convert/markdown/pdf endpoint, the application extracts the contents to a temporary working directory. However, the extraction routine fails to sanitize file paths contained within the ZIP archive. An attacker can craft a malicious ZIP file containing entries with path traversal sequences (such as ../) that, when extracted, write files outside the intended directory boundary.

The vulnerability requires authentication to exploit, limiting the attack surface to users with valid credentials. However, the impact on data integrity is significant as the attacker can overwrite any files writable by the stirlingpdfuser account under which the application runs.

Root Cause

The root cause is the absence of path validation when extracting ZIP entries in the Markdown to PDF conversion endpoint. The application directly uses the file paths specified within the ZIP archive without checking whether the resolved path falls within the expected temporary directory. This allows specially crafted ZIP files to include directory traversal sequences that escape the working directory boundary.

Attack Vector

The attack is network-accessible and requires low complexity to execute. An authenticated attacker can exploit this vulnerability by:

1. Crafting a malicious ZIP file containing files with path traversal sequences in their names (e.g., ../../etc/cron.d/malicious)
2. Submitting the ZIP file to the /api/v1/convert/markdown/pdf endpoint
3. The application extracts the contents, writing files to arbitrary locations on the filesystem

The vulnerability does not require user interaction and can be exploited directly through API calls. While confidentiality is not directly impacted, the arbitrary file write capability can lead to severe integrity compromises and potentially further exploitation depending on the system configuration and writable paths.

Detection Methods for CVE-2026-27625

Indicators of Compromise

• Unexpected file modifications or creations outside the Stirling-PDF working directory
• API requests to /api/v1/convert/markdown/pdf with suspicious ZIP file uploads
• Log entries showing file operations with path traversal sequences (../)
• Files owned by stirlingpdfuser appearing in unexpected system locations

Detection Strategies

• Monitor API access logs for requests to the /api/v1/convert/markdown/pdf endpoint with large or suspicious ZIP uploads
• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized modifications
• Review application logs for extraction errors or unusual file path references
• Deploy web application firewall (WAF) rules to detect ZIP slip attack patterns in uploaded content

Monitoring Recommendations

• Enable verbose logging for the Stirling-PDF application to capture file operation details
• Set up alerts for file creation events outside designated application directories
• Monitor system calls from the stirlingpdfuser process for writes to sensitive paths
• Implement network-level monitoring for suspicious file upload patterns to the affected endpoint

How to Mitigate CVE-2026-27625

Immediate Actions Required

• Upgrade Stirling-PDF to version 2.5.2 or later immediately
• Review system logs for evidence of exploitation attempts targeting the vulnerable endpoint
• Audit files owned by stirlingpdfuser for unexpected modifications or placements
• Temporarily disable or restrict access to the /api/v1/convert/markdown/pdf endpoint if immediate patching is not possible

Patch Information

The vulnerability has been fixed in Stirling-PDF version 2.5.2. Organizations should update to this version or later to remediate the vulnerability. The fix implements proper path validation to ensure extracted ZIP entries cannot escape the intended working directory.

For detailed information, see the GitHub Security Advisory GHSA-wccq-mg6x-2w22 and the Stirling-PDF v2.5.2 release notes.

Workarounds

• Restrict network access to the Stirling-PDF application to trusted users only
• Implement additional access controls at the reverse proxy level to limit exposure of the vulnerable endpoint
• Run Stirling-PDF in a containerized environment with minimal filesystem permissions
• Configure the application to run with a dedicated user account with restricted write permissions to minimize impact

# Configuration example - Restrict write permissions for the Stirling-PDF process user
# Limit the stirlingpdfuser to only write to necessary directories
chmod 755 /opt/stirling-pdf
chown root:root /opt/stirling-pdf
mkdir -p /opt/stirling-pdf/temp
chown stirlingpdfuser:stirlingpdfuser /opt/stirling-pdf/temp
chmod 700 /opt/stirling-pdf/temp