A vulnerability in Stirling-PDF allows an attacker to embed JavaScript in a filename carried by a user‑supplied upload. The application renders that filename directly into page markup through unsafe techniques such as innerHTML, causing the script to execute in the context of the uploading user’s browser. The impact is reflected cross‑site scripting, which can lead to session hijacking, data theft, or phishing attacks against users of the locally hosted web interface.

The flaw affects Stirling‑Tools’ Stirling‑PDF in all releases before version 2.0.0. Many upload endpoints across the application are susceptible; users who can upload files without restrictions may trigger the flaw.

The CVSS score of 3.1 classifies the issue as low severity, and the EPSS score is not available, indicating no known widespread exploitation. It is not listed in the CISA KEV catalog. Because the attack requires only the ability to upload a file to the application, an adversary with access to the local web service—such as an insider or a compromised workstation—can easily craft a malicious filename and trigger the XSS. The exploit does not require elevated privileges or authentication beyond the normal use of the upload feature.