CVE-2026-33437
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Stirling-PDF before version 2.0.0 has a stored XSS vulnerability in the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html. Untrusted PDF Title and Author metadata are inserted into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to access browser-session data or modify page content. This issue is fixed in version 2.0.0.
Risk Assessment
A user can be attacked by a malicious PDF file, potentially leading to session theft or page modification.
Recommendation
Upgrade Stirling-PDF to version 2.0.0 or later.
Original NVD description (English source)
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to access browser-session data or modify page content. This issue is fixed in version 2.0.0.