CVE-2026-119343

Stirling-PDF AI HTML tool permits SSRF and local file read

Stirling Tools · Stirling-PDF AI create-pdf-from-html-agent

First documented disclosure · Review checkpoint

Summary

The AI PDF tool can fetch internal URLs and embed files readable by the service.

Severity and exploitation evidence

Medium · 6.8/10 · CVSS 3.1. Severity source.

Exploitation not established: Controlled research or code-path evidence; the reviewed sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The AI endpoint sends client-supplied HTML to WeasyPrint without the sanitizer used by the regular conversion endpoint; resource references can resolve HTTP(S) or local files.

Conditions required

Access to the affected endpoint; when security.enableLogin is false it is unauthenticated. Network reachability and process file permissions bound the resources exposed.

Potential impact

Server-side requests to internal services or metadata endpoints and disclosure of readable local files through generated PDFs.

Affected versions and configurations

CNA: before 3.0.0. The original advisory specifically tested Docker 2.14.2.

Fix and mitigation status

3.0.0 per CNA and the updated advisory package table; use a current supported fixed release.

Practical next steps

Upgrade, require authentication for AI tool endpoints, restrict renderer egress and local-file schemes, and apply the same HTML sanitization across all rendering paths.

Operating lesson

Adding an AI tool must not bypass the protections of the existing conversion API.

Evidence and limits

Explicit public vulnerability disclosure is October 2; a linked July refactor and September 24 release predate it and are patch chronology, not inferred disclosure. The original report says no fix was then available, but its updated table and October 30 CNA name 3.0.0. Distinct from CVE-2025-46568 and CVE-2025-55150.

Sources