CVE-2025-55150

Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf

CVSS 8.6 HIGHEPSS 1.6%CWE-918

Vexday Risk Score

36Atenção

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

CVSS 8.6EPSS 1.6%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

11 ago 2025Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/html/pdf endpoint to convert HTML to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Produtos afetados

Stirling-Tools · Stirling-PDF

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/Stirling-Tools/Stirling-PDF/commit/7d6b70871bad2a3ff810825f7382c49f55293943 https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-xw8v-9mfm-g2pm