Executive brief
Stirling-PDF is a self-hosted web application used for managing and converting PDF documents. A security flaw in the email-to-PDF conversion feature allows malicious code embedded in an email to execute in a user's browser if they choose to download the intermediate HTML version of the file. This could lead to unauthorized access to the user's session, data theft, or further attacks on the internal network where the application is hosted.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Stirling-PDF version 2.7.3 within the EML-to-PDF conversion logic. When the 'downloadHtml=true' parameter is used on the /api/v1/convert/eml/pdf endpoint, the application fails to apply HTML sanitization to the email body, returning raw HTML with a 'text/html' content type. While the PDF conversion path correctly utilizes a sanitizer, the HTML export path passes a null sanitizer to the processing utility. An attacker can exploit this by crafting a malicious EML file containing JavaScript; if an authenticated user processes this file and selects the "Download HTML intermediate file" option, the script will execute in their browser context upon opening the file. This issue is resolved in version 2.8.0.
Affected products
- Stirling-Tools Stirling-PDF 2.7.3
Timeline
- 2026-03-25: advisory: GitHub Security Advisory published by maintainers
- 2026-03-26: disclosed: CVE-2026-34071 published to NVD
- 2026-03-26: patched: Version 2.8.0 released to address the vulnerability