Stirling-PDF
v3.3.0#1 PDF Application on GitHub that lets you edit PDFs on any device anywhere
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- OtherUnknown
- Security
- 16 advisories1 critical, 7 high, 5 medium, 3 low · Scorecard 7.1/10
- Supported versions
- No scheduleendoflife.date does not track this project
96.6k stars · 9.4k forks · 481 open issues · last release 10 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 16 most recent advisories published by the maintainers: 1 critical, 7 high, 5 medium, 3 low. Check the patched version against the one you run.
- criticalCVE-2026-85714Oct 2, 2026Remote Code Execution via H2
- Affected
- <= 2.11.0
- Patched in
- v2.13.2
- mediumCVE-2026-119342Oct 2, 2026SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass in Stirling-PDF
- Affected
- >=2.13.1
- Patched in
- 2.13.2
- mediumCVE-2026-119343Oct 2, 2026AI create-pdf-from-html-agent skips HTML sanitization enabling WeasyPrint SSRF and local file read
- Affected
- 2.14.2
- Patched in
- 3.0.0
- mediumGHSA-pp9g-47g3-f789Oct 2, 2026CSV formula injection in PDF-to-CSV export via /api/v1/convert/pdf/csv
- Affected
- < 3.0.0
- Patched in
- 3.0.0
- highCVE-2026-33437Jul 30, 2026Stored XSS in Stirling PDF Info Summary
- Affected
- <=1.1.0
- Patched in
- 2.0.0
- highCVE-2026-57485Jul 30, 2026Internal Service Account API Key Disclosure via Pipeline Endpoint
- Affected
- <= 2.8.0
- Patched in
- 2.9.0
- lowCVE-2026-41580May 23, 2026Reflected XSS through crafted PDF metadata fields (Title and Author)
- Affected
- 1.3.2
- Patched in
- 2.0.0
- lowCVE-2026-33436Apr 17, 2026Reflected XSS through crafted filename in file upload functionality
- Affected
- 1.3.2
- Patched in
- 2.0.0
- mediumCVE-2026-34071Mar 25, 2026Stored Cross Site Scripting (XSS) via EML-to-HTML Export
- Affected
- 2.7.3
- Patched in
- 2.8.0
- mediumCVE-2026-33438Mar 25, 2026Dos via add-watermark
- Affected
- 2.1.5
- Patched in
- 2.5.2
- highCVE-2026-27625Mar 20, 2026Path Traversal Vulnerability in /api/v1/convert/markdown/pdf Endpoint
- Affected
- 2.5.0
- Patched in
- 2.5.2
- highCVE-2025-55161Aug 11, 2025SSRF vulnerability on /api/v1/convert/markdown/pdf
- Affected
- all versions
- Patched in
- 1.1.0
- highCVE-2025-55150Aug 11, 2025SSRF vulnerability on /api/v1/convert/html/pdf
- Affected
- all versions
- Patched in
- 1.1.0
- highCVE-2025-55151Aug 11, 2025SSRF vulnerability on /api/v1/convert/file/pdf
- Affected
- all versions
- Patched in
- 1.1.0
- highCVE-2025-46568Mar 26, 2025Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability
- Affected
- ＜0.44.3
- Patched in
- 0.45.0
- lowCVE-2024-52286Nov 11, 2024Self Cross Site Scripting (XSS) In Merge Functionality
- Affected
- <0.32.0
- Patched in
- 0.32.0