CVE-2026-71270
Received Received - Intake

Server-Side Request Forgery in Stirling-PDF via URL Conversion

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf). The endpoint validates only that the initial requested URL resolves to a public IP, then fetches the page's HTML server-side and hands it, unsanitized, to a WeasyPrint subprocess. Embedded resource references in the fetched HTML (e.g. `<img src="http://169.254.169.254/...">`) are fetched by WeasyPrint with no per-resource SSRF filtering, allowing an attacker-controlled page to cause the server to retrieve cloud metadata endpoints or internal network resources and leak their contents back into the generated PDF.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71270
EUVD
EUVD-2026-53355

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
stirling-tools stirling_pdf *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Stirling-PDF's /api/v1/convert/url/pdf endpoint lacked SSRF protections added to other conversion endpoints. It fetches HTML from a user-provided URL after checking if it resolves to a public IP, then converts it to PDF without sanitizing embedded resources. This allows attackers to embed references to internal or cloud metadata endpoints in the HTML, which WeasyPrint then fetches and includes in the PDF, leaking sensitive data.

Detection Guidance

Detecting this vulnerability requires checking if Stirling-PDF's /api/v1/convert/url/pdf endpoint is accessible and if SSRF protections are missing. Monitor network traffic for unexpected outbound requests from the server hosting Stirling-PDF, particularly to internal or cloud metadata endpoints. Check application logs for unsanitized HTML fetches or WeasyPrint subprocess calls with embedded resource references.

Impact Analysis

An attacker could exploit this to make your server retrieve internal network resources or cloud metadata (like AWS IMDS) and include their contents in generated PDFs. This could expose sensitive server information, internal IP addresses, or cloud credentials, potentially leading to further attacks or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using Stirling-PDF may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Immediately disable the /api/v1/convert/url/pdf endpoint if not required. Apply SSRF protections (CustomHtmlSanitizer/SsrfProtectionService) to this endpoint to match the other conversion endpoints. Update Stirling-PDF to the latest version where this issue is fixed. Restrict network access to the server to prevent unauthorized outbound requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart