CVE-2026-119343

Name of the Vulnerable Software and Affected Versions Stirling-PDF versions prior to 3.0.0

Description The application fails to use a CustomHtmlSanitizer when processing the htmlContent variable at the 'POST /api/v1/ai/tools/create-pdf-from-html-agent' endpoint. This allows the input to be passed directly to WeasyPrint, enabling server-side requests to internal or cloud-metadata destinations via HTTP and HTTPS resource references. Additionally, file references can be used to embed local content accessible by the application process into the resulting PDF. The endpoint is accessible without authentication if security.enableLogin is set to false.

Recommendations Update to version 3.0.0. As a temporary mitigation, set security.enableLogin to true to restrict access to the endpoint.