# CVE-2026-119342: Stirling-PDF arbitrary file disclosure via SVG rendering

Source: https://junglewise.ai/threats/cve-2026-119342-stirling-pdf-is-a-locally-hosted-web-application-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119342 · Severity: medium · CVSS 5.3 · Published 2026-10-30

Stirling-PDF is a web application for manipulating PDF files. A vulnerability in its SVG-to-PDF conversion feature allows attackers to extract image files (PNG, JPG, GIF, SVG) from the server and embed them into PDFs. The flaw affects systems with or without login enabled, potentially exposing sensitive image content without authentication.

Technologies: [Stirling-Tools Stirling-PDF](https://junglewise.ai/threats/technologies/stirling-tools-stirling-pdf). Vendors: [Stirling-Tools](https://junglewise.ai/threats/vendors/stirling-tools).

## Quick answers

**Is CVE-2026-119342 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119342 being exploited in the wild.

**How severe is CVE-2026-119342?** Medium severity, with a CVSS score of 5.3, published 30 October 2026.

**Which products and versions are affected?** Stirling-Tools Stirling-PDF 2.13.1 and earlier.

**Is there a fix for CVE-2026-119342?** Yes: fixed in 2.13.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119342 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-119342?** Check whether you run Stirling-Tools Stirling-PDF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.13.2

## Technical details

The POST /api/v1/convert/svg/pdf endpoint in versions 2.13.1 and prior uses Apache Batik to render SVG files. A scheme-less, root-relative image reference in the SVG bypasses the SvgSanitizer.isExternalUrl() check, causing Batik to resolve it as a same-origin local file using the file:/// protocol. An attacker supplies a crafted SVG with image paths to exfiltrate image-decodable files, which are then rendered into the returned PDF. The attack requires network access but works without authentication on login-disabled deployments or with non-admin credentials when login is enabled.

## Affected products

- Stirling-Tools Stirling-PDF 2.13.1 and earlier

## Timeline

- 2026-10-30: disclosed

## References

- [https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5](https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5)
- [https://github.com/Stirling-Tools/Stirling-PDF/pull/6796](https://github.com/Stirling-Tools/Stirling-PDF/pull/6796)

## Related threats

- [Stirling-PDF unsanitized HTML to PDF conversion in create-pdf-from-html-agent](https://junglewise.ai/threats/cve-2026-119343-stirling-pdf-is-a-locally-hosted-web-application-that)
- [Stirling-PDF SQL injection in database import endpoint](https://junglewise.ai/threats/cve-2026-85714-stirling-pdf-is-a-locally-hosted-web-application-that-facilitates)