CVE-2026-71270

Name of the Vulnerable Software and Affected Versions Stirling-PDF (affected versions not specified)

Description The POST /api/v1/convert/url/pdf endpoint in ConvertWebsiteToPDF.java lacks Server-Side Request Forgery (SSRF) protections. While the endpoint verifies that the initial URL resolves to a public IP, it fetches the HTML and passes it unsanitized to a WeasyPrint subprocess. This allows an attacker to use embedded resource references, such as <img> tags, to force the server to retrieve internal network resources or cloud metadata endpoints and include their contents in the resulting PDF.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.