CVE-2026-113606 Stirling-Tools CVE debrief

Who should care

Defenders responsible for Stirling-PDF installations, security teams, and administrators should be aware of this vulnerability and take necessary actions to mitigate it. This includes verifying and remediating the vulnerability, restricting access to sensitive files, and monitoring for suspicious activity. Additionally, operators, platform administrators, and vulnerability management teams should also be aware of the potential impact and take necessary措施.

Why it matters

CVE-2026-113606 is a high-severity authorization bypass vulnerability in Stirling-PDF that allows authenticated users to access other users' stored files. Defenders should prioritize verifying and remediating this vulnerability to prevent potential unauthorized access and data breaches.

• Potential unauthorized access to sensitive files
• Possible data breaches or modifications
• Need for verification of vendor-provided patches

Technical summary

The vulnerability allows authenticated users to access other users' stored files by manipulating processing folders to target server storage directories. This can be achieved by creating a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, listing files, and running pipelines to read, modify, or destroy victims' files. The vulnerability has a high severity with a CVSS score of 7.1 and affects Stirling-PDF versions 3.0.0 through 3.2.0. Defenders should prioritize verifying and remediating this vulnerability to prevent potential unauthorized access and data breaches.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Stirling-PDF installations, focusing on restricting access to sensitive files and monitoring for suspicious activity.

Recommended defensive actions

• Verify Stirling-PDF version and restrict access to sensitive files
• Monitor for suspicious activity and implement additional security measures
• Review and apply vendor-provided patches or updates
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and advisories. The vulnerability was published on 2026-10-20T15:40:32.691Z and has not been modified since then. There are multiple sources that provide technical descriptions of the vulnerability, including references 4 and 5.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.