Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.
References
| Link | Resource |
|---|---|
| https://github.com/Stirling-Tools/Stirling-PDF/commit/7d6b70871bad2a3ff810825f7382c49f55293943 | Patch |
| https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-ff33-grr6-rmvp | Third Party Advisory Exploit |
Configurations
History
15 Aug 2025, 18:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/Stirling-Tools/Stirling-PDF/commit/7d6b70871bad2a3ff810825f7382c49f55293943 - Patch | |
| References | () https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-ff33-grr6-rmvp - Third Party Advisory, Exploit | |
| CPE | cpe:2.3:a:stirlingpdf:stirling_pdf:*:*:*:*:*:*:*:* | |
| Summary | (es) Stirling-PDF es una aplicación web alojada localmente que realiza diversas operaciones con archivos PDF. Antes de la versión 1.1.0, al usar el endpoint /api/v1/convert/markdown/pdf para convertir Markdown a PDF, el backend invocaba una herramienta externa para procesarlo e incluía un depurador de seguridad que se puede omitir y generar un SSRF. Este problema se ha corregido en la versión 1.1.0. | |
| First Time |
Stirlingpdf
Stirlingpdf stirling Pdf |
12 Aug 2025, 14:25
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
11 Aug 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-08-11 23:15
Updated : 2025-08-15 18:05
NVD link : CVE-2025-55161
Mitre link : CVE-2025-55161
CVE.ORG link : CVE-2025-55161
JSON object : View
Products Affected
stirlingpdf
- stirling_pdf
CWE
CWE-918
Server-Side Request Forgery (SSRF)