ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27625

Stirling-PDF is a locally hosted web application that performs various operations on PDF files.

Published Mar 20, 2026 · updated Jun 17, 2026 · stirling stirling pdf

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZIP entries without path checks. Any authenticated user can write files outside the intended temporary working directory, leading to arbitrary file write with the privileges of the Stirling-PDF process user (stirlingpdfuser). This can overwrite writable files and compromise data integrity, with further impact depending on writable paths. The issue was fixed in version 2.5.2.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 20, 2026 · NIST NVD

    Detected

    Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZIP entries without path checks. Any authenticated user can write files outside the intended temporary working directory, leading to arbitrary file write with the privileges of the Stirling-PDF process user (sti

  2. Jun 17, 2026 · NIST NVD

    Updated

    Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZIP entries without path checks. Any authenticated user can write files outside the intended temporary working directory, leading to arbitrary file write with the privileges of the Stirling-PDF process user (sti

Affected

  • cpe stirling/stirling pdfversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-27625

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-27625

    Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZIP entries without path checks. Any authenticated user can write files outside the intende

    nvd.nist.gov

References