Is CVE-2026-33436 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-33436 being exploited in the wild.

How severe is CVE-2026-33436?

Low severity, with a CVSS score of 3.1, published 17 April 2026.

Which products and versions are affected?

Stirling-Tools Stirling-PDF < 2.0.0.

Is there a fix for CVE-2026-33436?

A patch was published on 2026-04-17: Fixed in version 2.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-33436 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-33436?

Check whether you run Stirlingpdf Stirling Pdf. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33436: Stirling-PDF reflected XSS in file upload endpoints

Q: Is there a fix for CVE-2026-33436?

A patch was published on 2026-04-17: Fixed in version 2.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-33436 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-33436?

Check whether you run Stirlingpdf Stirling Pdf. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-33436 · Severity: low · CVSS 3.1 · Published 2026-04-17

Stirling-PDF is a self-hosted web application used for managing and editing PDF documents. A security flaw in the application's file upload system allows an attacker to execute malicious scripts in a user's browser if the user is tricked into uploading a file with a specially crafted name. This could lead to the theft of sensitive session information, such as cookies, or unauthorized actions performed on behalf of the user.

Technologies: Stirlingpdf Stirling Pdf. Vendors: Stirlingpdf.

Quick answers

Is CVE-2026-33436 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-33436 being exploited in the wild.
How severe is CVE-2026-33436?: Low severity, with a CVSS score of 3.1, published 17 April 2026.
Which products and versions are affected?: Stirling-Tools Stirling-PDF < 2.0.0.
Is there a fix for CVE-2026-33436?: A patch was published on 2026-04-17: Fixed in version 2.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33436 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-33436?: Check whether you run Stirlingpdf Stirling Pdf. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in Stirling-PDF versions prior to 2.0.0. The root cause is the use of unsafe JavaScript methods like 'innerHTML' to display uploaded filenames in the web interface without prior sanitization or output encoding. An attacker can exploit this by inducing a user to upload a file with a malicious filename containing JavaScript (e.g., <img src=x onerror=alert(1)>.pdf). Upon upload, the script executes within the context of the victim's browser session. This affects numerous endpoints including /merge-pdfs, /split-pdfs, and /convert-to-pdf. The issue is addressed in version 2.0.0 by implementing proper input validation and output escaping.

Affected products

Stirling-Tools Stirling-PDF < 2.0.0

Timeline

2026-04-17: disclosed
2026-04-17: advisory
2026-04-17: patched: Fixed in version 2.0.0

References

https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-q5j3-4m5w-wp75

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.