CVE-2026-33437

Name of the Vulnerable Software and Affected Versions Stirling-PDF versions prior to 2.0.0

Description The Get Info workflow in the file app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element using innerHTML. This allows a malicious PDF to execute stored cross-site scripting (XSS)—a technique where malicious scripts are permanently stored on the target server—when a user clicks Get Info, potentially enabling access to browser-session data or modification of page content.

Recommendations Update to version 2.0.0.