CVE-2026-71270 Stirling-Tools CVE debrief

Who should care

Administrators and users of Stirling-PDF, especially those exposed to public networks, should be aware of this vulnerability and take immediate action to protect their systems. Operators, platform administrators, and security teams should review affected scope, severity, and vendor guidance to ensure proper mitigation and remediation efforts are undertaken. Vulnerability management and security teams should prioritize defensive actions based on the HIGH CVSS score of 8.6 and the potential for SSRF attacks. Asset inventory and monitoring should be reviewed to detect potential exposure. Rollback/change windows and source tracking should be considered to prevent and detect potential attacks. Compensating controls should be evaluated for exposed systems while remediation is scheduled and verified. Exposure review and vendor patch guidance should be sought to ensure proper mitigation and remediation efforts are undertaken. Monitoring and detection capabilities should be reviewed to ensure adequate coverage of potential attacks. Asset inventory and source tracking should be used to identify and prioritize remediation efforts.

Technical summary

The POST /api/v1/convert/url/pdf endpoint in Stirling-PDF is vulnerable to SSRF attacks due to the lack of CustomHtmlSanitizer/SsrfProtectionService protections. This allows an attacker to cause the server to retrieve cloud metadata endpoints or internal network resources and leak their contents back into the generated PDF. Affected product deployments should be identified, and defenders should review compensating controls for exposed systems.

Defensive priority

High-priority defensive actions are required due to the HIGH CVSS score of 8.6 and the potential for SSRF attacks.

Recommended defensive actions

• Implement CustomHtmlSanitizer/SsrfProtectionService SSRF protections for the POST /api/v1/convert/url/pdf endpoint
• Validate and sanitize user-input URLs
• Restrict access to the endpoint
• Monitor for suspicious activity
• Apply WeasyPrint per-resource SSRF filtering

Evidence notes

Evidence is limited; primary official records indicate a vulnerability in Stirling-PDF's POST /api/v1/convert/url/pdf endpoint. The endpoint lacks CustomHtmlSanitizer/SsrfProtectionService SSRF protections, allowing potential SSRF attacks. Defenders should verify affected deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources