CVE-2026-41580: Stirling-PDF XSS Vulnerability

CVE-2026-41580 Overview

CVE-2026-41580 is a stored cross-site scripting (XSS) vulnerability in Stirling-PDF, a locally hosted web application for PDF manipulation. Versions prior to 2.0.0 fail to sanitize PDF Title and Author metadata fields when rendered through the /get-info-on-pdf endpoint. An attacker can craft a malicious PDF that executes arbitrary JavaScript in the browser of any user who views the file information page. The flaw is categorized under CWE-79 and is resolved in Stirling-PDF version 2.0.0.

Critical Impact
Attackers can execute arbitrary JavaScript in victim browsers by tricking users into viewing metadata for a crafted PDF, enabling session theft, credential harvesting, and unauthorized actions within the Stirling-PDF interface.

Affected Products

Stirling-PDF versions prior to 2.0.0
Self-hosted Stirling-PDF instances exposing the /get-info-on-pdf endpoint
Deployments processing untrusted PDF uploads

Discovery Timeline

2026-07-15 - CVE-2026-41580 published to NVD
2026-07-15 - Last updated in NVD database
v2.0.0 - Stirling-Tools releases patched version on GitHub

Technical Details for CVE-2026-41580

Vulnerability Analysis

Stirling-PDF exposes a /get-info-on-pdf endpoint that parses and displays document metadata extracted from uploaded PDF files. The endpoint reads PDF Title and Author fields directly from the document dictionary and injects them into the returned HTML page without applying HTML encoding or sanitization. When a user views the info page for a crafted PDF, the browser interprets attacker-supplied markup as executable content rather than text.

The vulnerability requires user interaction because a victim must actively request metadata for the malicious file. However, the attack surface is broad in multi-user deployments where PDFs are shared or processed on behalf of others. The scope change reflected in the CVSS vector indicates the injected script can affect resources beyond the vulnerable component, such as authenticated sessions on the same origin.

Root Cause

The root cause is missing output encoding on user-controlled data flowing from PDF metadata into an HTML response. PDF metadata fields accept arbitrary strings, and the application treats these strings as trusted content. Without contextual escaping, characters such as <, >, and " retain their HTML significance and enable script tag injection or event handler attributes.

Attack Vector

An attacker crafts a PDF whose /Title or /Author entry in the document information dictionary contains an HTML payload, for example a <script> tag or an <img> element with an onerror handler. The attacker then delivers the PDF to a Stirling-PDF user through email, upload, or shared storage. When the victim opens the metadata view via /get-info-on-pdf, the payload executes in the browser under the origin of the Stirling-PDF instance.

Refer to the GitHub Security Advisory GHSA-rjjx-43g5-mp76 for the vendor's technical writeup.

Detection Methods for CVE-2026-41580

Indicators of Compromise

PDF files uploaded to Stirling-PDF containing HTML tags, script elements, or JavaScript event handlers within Title or Author metadata fields
Unexpected outbound requests from user browsers immediately after accessing /get-info-on-pdf responses
Session cookies or authentication tokens appearing in web server logs of attacker-controlled domains

Detection Strategies

Inspect PDF metadata at ingestion using tools such as exiftool or pdfinfo and flag documents whose Title or Author fields contain angle brackets, script keywords, or JavaScript URIs
Monitor HTTP responses from /get-info-on-pdf for reflected metadata containing unescaped HTML markup
Deploy Content Security Policy (CSP) violation reporting to surface inline script execution originating from the Stirling-PDF origin

Monitoring Recommendations

Enable web application firewall logging for requests to the /get-info-on-pdf endpoint and review responses for HTML injection patterns
Alert on anomalous JavaScript execution or DOM manipulation in browser sessions accessing the Stirling-PDF application
Correlate PDF upload events with subsequent metadata view requests to identify potential targeted delivery

How to Mitigate CVE-2026-41580

Immediate Actions Required

Upgrade Stirling-PDF to version 2.0.0 or later using the release available on the Stirling-PDF GitHub releases page
Restrict access to the Stirling-PDF instance to trusted users until the upgrade is applied
Audit recent PDF uploads for suspicious metadata that may indicate exploitation attempts

Patch Information

Stirling-Tools resolved the issue in Stirling-PDF v2.0.0 by applying proper HTML encoding to PDF metadata before rendering. Users should upgrade using their preferred deployment method, whether Docker image, JAR file, or source build. Details are documented in GitHub Security Advisory GHSA-rjjx-43g5-mp76.

Workarounds

Place Stirling-PDF behind a reverse proxy that strips or sanitizes HTML characters in responses from the /get-info-on-pdf endpoint
Enforce a strict Content Security Policy that disallows inline scripts on the Stirling-PDF origin to prevent payload execution
Preprocess uploaded PDFs to remove or normalize Title and Author metadata fields before making files available to end users

bash

# Example: strip PDF metadata before serving to Stirling-PDF users
exiftool -Title= -Author= -overwrite_original suspicious.pdf