Stirling-PDF’s conversion endpoint allows a user to upload an SVG file that the application renders into a PDF. The SVG is passed to Apache Batik after passing through a sanitiser that incorrectly treats scheme‑less root‑relative image references as external URLs. This flaw lets an attacker craft SVG that references local files on the server. When the SVG is rendered, the referenced files are read and embedded into the resulting PDF. The vulnerability can reveal image‑decodable content such as PNG, JPG, GIF or SVG files and provides an existence oracle for such paths. No arbitrary code execution or wide‑scale data exfiltration is possible, but sensitive images or documents stored on the host can be disclosed to the attacker. The weakness is an instance of improper input validation and improper handling of file references (CWE‑20, CWE‑22, CWE‑610, CWE‑918).

The issue affects all installations of the Stirling‑Tools Stirling‑PDF web application ranging from version 2.13.1 up to but not including 2.13.2. The vulnerability manifests in the /api/v1/convert/svg/pdf endpoint and the addSvgAsPage() path used for converting or embedding SVG content. Both authentication‐disabled deployments and deployments with login enabled are vulnerable unless the attacker has admin rights, because the route is accessible to any user by default.

The CVSS base score of 5.3 indicates moderate impact. The EPSS score is not available, so the probability of exploitation cannot be quantified from public data. The flaw is not listed in CISA’s KEV catalog. An attacker would need to access the locally hosted service to send a crafted payload; the attack vector is therefore inferred to be a local or network‑based web request. Because the vulnerability can disclose file contents without authentication on login‑disabled setups, the potential impact is significant for environments where sensitive files are stored on the same host.