The POST /api/v1/convert/url/pdf endpoint in Stirling‑PDF lacks the SSRF protections applied to other conversion routes. It validates only that the requested URL resolves to a public IP, then fetches the page’s HTML and hands the unsanitized content to a WeasyPrint subprocess. Embedded resources such as <img src="http://169.254.169.254/..."> are fetched by WeasyPrint without per‑resource filtering, allowing an attacker‑controlled page to cause the server to retrieve internal or cloud metadata endpoints and embed those contents in the generated PDF. The flaw is a Server‑Side Request Forgery (CWE‑918) that can lead to confidential data disclosure.

The affected product is Stirling‑Tools’ Stirling‑PDF. No specific version range is provided by the CNA, so all publicly available releases that implement the /api/v1/convert/url/pdf endpoint are potentially vulnerable until a fix is released.

This vulnerability has a CVSS score of 8.6, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the /api/v1/convert/url/pdf endpoint accepts POST requests but the authentication requirements are not documented; an attacker could therefore submit a crafted URL to force the server to retrieve arbitrary resources. Successful exploitation can expose internal network addresses, cloud metadata, or other sensitive data through the PDF output, presenting a significant risk to confidentiality and potentially enabling further attacks.