CVE-2026-119343

The record

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 3.0.0, POST /api/v1/ai/tools/create-pdf-from-html-agent accepts attacker-controlled htmlContent and passes it to WeasyPrint without CustomHtmlSanitizer, unlike the sanitized /api/v1/convert/html/pdf control path. HTTP and HTTPS resource references can make server-side requests to internal or cloud-metadata destinations, while file references can embed local content readable by the Stirling-PDF process into the generated PDF. The endpoint is reachable without credentials when security.enableLogin is false, and the flaw is distinct from earlier Stirling-PDF WeasyPrint vulnerabilities in older conversion paths. This issue is fixed in version 3.0.0.

Affected packages

Related vulnerabilities

• CVE-2026-119328 Immich is a high-performance self-hosted photo and video management solution. CWE-73
• CVE-2026-116249 In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and… CWE-73
• CVE-2026-119298 croc is a tool that allows any two computers to simply and securely transfer files and… CWE-73
• CVE-2026-61738 SOCFortress CoPilot focuses on providing a single pane of glass for all your security… CWE-73
• CVE-2026-5461 The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all… CWE-73
• CVE-2026-118561 External Control of File Name or Path vulnerability in Drupal Single Content Sync allows… CWE-73
• CVE-2026-119210 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-73
• CVE-2026-119198 Nuxt is an open-source web development framework for Vue.js. CWE-73