CVE-2026-41580 — Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title an…
Published: 2026-07-15 · CVSS: 6.1 · CVSS 3.1
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7