CVE-2026-41580

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Stirling-PDF via PDF Metadata

Publication date: 2026-07-15

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-30

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-41580

EUVD

EUVD-2026-44691

Affected Vendors & Products

Vendor	Product	Version / Range
stirling	stirling_pdf	to 2.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-41580 is a Reflected Cross-Site Scripting (XSS) vulnerability in Stirling-PDF before version 2.0.0. It occurs in the /get-info-on-pdf endpoint where PDF Title and Author metadata fields are rendered without proper HTML encoding or sanitization. Attackers can craft a PDF with malicious JavaScript in these fields, which executes in a user's browser when they view the page. This allows stealing data or redirecting users.

Detection Guidance

To detect this vulnerability, inspect PDF files uploaded to Stirling-PDF for malicious metadata in Title or Author fields. Use tools like pdfinfo to extract metadata and check for JavaScript or unusual characters. Example command: pdfinfo suspicious.pdf | grep -i 'title\|author'.

Impact Analysis

An attacker could steal sensitive data like cookies or localStorage, manipulate page content, or redirect users to malicious sites. This occurs when a user uploads and views a crafted PDF file in vulnerable Stirling-PDF versions.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance breaches if user data is compromised through this attack.

Mitigation Strategies

Upgrade Stirling-PDF to version 2.0.0 or later immediately. Avoid processing untrusted PDFs until patched. Monitor network traffic for unusual activity from Stirling-PDF instances.

Hi! I’m here to help you understand CVE-2026-41580. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70