CVE-2026-27625 - Vulnerability Analysis

Overview

Stirling-PDF < 2.5.2 contains a path traversal caused by lack of path checks when extracting user-supplied ZIP entries in /api/v1/convert/markdown/pdf, letting authenticated users write arbitrary files outside intended directories.

Severity & Score

Impact

Authenticated users can write arbitrary files with Stirling-PDF process privileges, potentially leading to data integrity compromise and further system impact.

Mitigation

Upgrade to version 2.5.2 or later.

References

• https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.5.2
• https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-wccq-mg6x-2w22

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner