CVE-2026-119342

Name of the Vulnerable Software and Affected Versions Stirling-PDF versions 2.13.1 through 2.13.1

Description The application renders attacker-supplied SVG files via Apache Batik. A scheme-less root-relative image reference can bypass the isExternalUrl() function in SvgSanitizer, allowing Batik to resolve the reference against the file:///input.svg document base as a same-origin local file. This occurs within the convert() and addSvgAsPage() functions in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java. Consequently, image-decodable server files such as PNG, JPG, GIF, or SVG can be rendered into the resulting PDF. This can be exploited without authentication on deployments where login is disabled, or by users with non-admin access when login is enabled. The issue also provides an existence oracle for image-decodable paths, but does not disclose plain text, binary files, directories, XInclude text, external entities, explicit file URLs, or HTTP references. The affected endpoint is 'POST /api/v1/convert/svg/pdf'.

Recommendations Update to version 2.13.2.