{"id":"CVE-2026-119342","aliases":[],"cve":{"records":[{"id":"CVE-2026-119342","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-29T20:44:30.286Z","published":"2026-10-30T20:28:30.049Z","modified":"2026-10-30T20:28:30.049Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T20:28:30.049Z"}],"references":[{"url":"https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-pr4g-9qp2-g8j8","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/Stirling-Tools/Stirling-PDF/pull/6796","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-20","description":"CWE-20: Improper Input Validation","source":"GitHub_M"},{"id":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","source":"GitHub_M"},{"id":"CWE-610","description":"CWE-610: Externally Controlled Reference to a Resource in Another Sphere","source":"GitHub_M"},{"id":"CWE-918","description":"CWE-918: Server-Side Request Forgery (SSRF)","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2.","score":5.3,"severity":"medium","published":"2026-10-30T20:28:30.049Z","modified":"2026-10-30T20:28:30.049Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Stirling-Tools","name":"Stirling-PDF","platforms":[],"versions":[{"version":">= 2.13.1, < 2.13.2","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-119342"}],"remediation":[],"references":["https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-pr4g-9qp2-g8j8","https://github.com/Stirling-Tools/Stirling-PDF/pull/6796","https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5","https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2"],"sources":[{"name":"CVE","id":"CVE-2026-119342","modified":"2026-10-30T20:28:30.049Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-119342"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3}],"sourceAffected":[],"observedAt":"2026-10-30T21:23:15.085Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T02:55:33.139Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T21:55:32.519Z","attemptedAt":"2026-10-30T21:55:32.519Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T21:55:32.844Z","attemptedAt":"2026-10-30T21:55:32.844Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T21:55:32.845Z","attemptedAt":"2026-10-30T21:55:32.845Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T21:55:32.845Z","attemptedAt":"2026-10-30T21:55:32.845Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-119342","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119342","modified":"2026-10-30T21:16:53.350","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-10-30T21:55:32.519Z"}],"aiSummary":null}