An authenticated user can submit a ZIP file to the Markdown‑to‑PDF conversion endpoint. The application extracts ZIP entries without validating their paths, allowing a path traversal exploit that writes files outside the intended temporary directory. This gives the process user the ability to overwrite any writable file, compromising data integrity and potentially enabling further escalation depending on the target files.

Stirling‑Tools: Stirling‑PDF versions earlier than 2.5.2 are affected. The vulnerability exists in the locally hosted web application’s API endpoint /api/v1/convert/markdown/pdf.

The CVSS score of 8.1 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires authentication and access to the API, making it an authenticated local or network‑based attack. After patching to version 2.5.2, the path validation is restored, eliminating this vector.