Description
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version 2.7.3, the /api/v1/convert/eml/pdf endpoint with parameter downloadHtml=true returns unsanitized HTML from the email body with Content-Type: text/html. An attacker who sends a malicious email to a Stirling-PDF user can achieve JavaScript execution when that user exports the email using the "Download HTML intermediate file" feature. Version 2.8.0 fixes the issue.
Published: 2026-03-26
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored XSS enabling JavaScript execution within the browser when a user exports a malicious email
Action: Patch Immediately
AI Analysis

Impact

The vulnerability lies in the /api/v1/convert/eml/pdf endpoint when downloadHtml=true, as Stirling-PDF returns unsanitized HTML from an email body. An attacker who can send a crafted email to a user can have that user execute arbitrary scripts in their browser upon exporting the email to HTML.

Affected Systems

Stirling-Tools’ Stirling-PDF version 2.7.3 is affected. The issue is fixed in version 2.8.0. No other products or versions are listed as affected.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate risk, while an EPSS score below 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack likely requires an attacker to deliver a malicious email to a user who subsequently uses the Export HTML feature, so it is a location–adversary combination that is primarily local to the user’s environment. Known remediation is to upgrade to the fixed version, which removes the ability to export unsanitized HTML.

Generated by OpenCVE AI on April 1, 2026 at 06:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Stirling-PDF to version 2.8.0 or later.
  • If an immediate upgrade is not possible, disable the Export HTML feature or block the downloadHtml parameter for email imports.
  • Consider monitoring or filtering incoming emails for malicious script content before import.

Generated by OpenCVE AI on April 1, 2026 at 06:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 14 May 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Stirling
Stirling stirling Pdf
CPEs cpe:2.3:a:stirlingpdf:stirling_pdf:2.7.3:*:*:*:*:*:*:* cpe:2.3:a:stirling:stirling_pdf:2.7.3:*:*:*:*:*:*:*
Vendors & Products Stirling
Stirling stirling Pdf

Wed, 01 Apr 2026 02:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:stirlingpdf:stirling_pdf:2.7.3:*:*:*:*:*:*:*

Fri, 27 Mar 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Stirlingpdf
Stirlingpdf stirling Pdf
Vendors & Products Stirlingpdf
Stirlingpdf stirling Pdf

Thu, 26 Mar 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 17:15:00 +0000

Type Values Removed Values Added
Description Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version 2.7.3, the /api/v1/convert/eml/pdf endpoint with parameter downloadHtml=true returns unsanitized HTML from the email body with Content-Type: text/html. An attacker who sends a malicious email to a Stirling-PDF user can achieve JavaScript execution when that user exports the email using the "Download HTML intermediate file" feature. Version 2.8.0 fixes the issue.
Title Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

Stirling Stirling Pdf
Stirlingpdf Stirling Pdf
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-26T19:52:10.821Z

Reserved: 2026-03-25T16:21:40.867Z

Link: CVE-2026-34071

cve-icon Vulnrichment

Updated: 2026-03-26T19:50:38.617Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-26T17:16:41.647

Modified: 2026-05-14T20:04:44.610

Link: CVE-2026-34071

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-02T07:58:56Z

Weaknesses