CVE-2026-119342

The record

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2.

Affected packages

Related vulnerabilities

• CVE-2026-63339 IXP Manager is a full-stack web application for managing Internet Exchange Points. CWE-20
• CVE-2026-62958 libriscv is a RISC-V sandbox and emulator. CWE-20
• CVE-2026-119339 Tesseract is an open source OCR engine. CWE-20
• CVE-2026-62335 OpenVM is a performant and modular zkVM framework built for customization and… CWE-20
• CVE-2026-62337 SNARK Verifier is a generic (S)NARK verifier. CWE-20
• CVE-2026-62333 OpenVM is a performant and modular zkVM framework built for customization and… CWE-20
• CVE-2026-61618 SNARK Verifier is a generic (S)NARK verifier. CWE-20
• CVE-2026-59978 AdminNeo is a full-featured database management tool written in PHP. CWE-20