CVE-2026-113606 in Stirling-PDF
Summary
by MITRE • 10/20/2026
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Stirling-PDF versions 3.0.0 through 3.2.0 represents a critical authorization bypass that undermines the fundamental isolation mechanisms designed to protect user data within the application environment. This flaw allows authenticated users to escalate their privileges effectively by manipulating how processing folders are configured and linked to underlying storage directories. The core of the issue lies in the insufficient validation of directory paths when creating or modifying processing folders via the API endpoint POST /api/v1/processing-folders. Instead of restricting access solely to files within the user's designated private storage partition, the application permits users to specify arbitrary server-side paths as targets for their processing operations. This lack of strict path canonicalization and boundary enforcement enables an attacker to point a legitimate processing folder at the storage directory associated with another victim user, identified by their unique user ID in the file system structure such as storage/<victimUserId>.
From a technical perspective, this vulnerability stems from improper access control checks during the configuration phase rather than during execution. When an authenticated actor submits a request to create or update a processing folder, the backend logic fails to verify that the specified target directory resides within the authorized scope of the requesting user's account space. By directing the pipeline engine toward a path outside their own sandboxed environment, the attacker gains read and write access to files belonging to other tenants in multi-user deployments or other local users in single-server setups. This mechanism bypasses standard authentication checks because the initial login validates identity, but subsequent file operations rely on flawed authorization logic that trusts user-supplied paths without adequate sanitization against directory traversal or cross-account path resolution errors.
The operational impact of this vulnerability is severe, as it compromises data confidentiality, integrity, and availability for all users sharing the instance. An attacker can enumerate files within a victim's storage area by listing the contents of the targeted folder through subsequent API calls. Once access is established, the ability to run pipelines against these folders allows the adversary to read sensitive documents, modify critical configuration or content files, or delete data entirely. This level of control effectively grants full administrative-like capabilities over other users' private workspaces without requiring elevated system privileges or additional exploits beyond valid credentials for any existing account on the platform. In multi-tenant SaaS environments, this could lead to significant regulatory compliance violations and loss of trust due to cross-user data leakage.
This flaw aligns with CWE-284 Improper Access Control, specifically reflecting a failure in enforcing proper authorization boundaries between different user contexts. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, where the attacker leverages legitimate credentials to perform unauthorized actions by exploiting misconfigured access controls rather than breaking authentication protocols directly. The exploitation path resembles aspects of CWE-22 Path Traversal in that it involves manipulating file system paths to access unintended resources, although here the mechanism is through application-level configuration parameters rather than input injection into a single endpoint.
Mitigation strategies must focus on enforcing strict server-side validation of all directory paths provided by users during processing folder creation and modification operations. Developers should implement canonicalization checks to ensure that resolved absolute paths remain strictly within the authorized user's designated storage root directory, rejecting any requests where the target path escapes this boundary via relative navigation or symbolic link resolution. Additionally, implementing least-privilege principles for file system access at the application runtime level can limit damage even if such a bypass occurs. For users of affected versions, upgrading to version 3.2.1 or later is essential as these releases contain patches addressing the authorization logic flaws. Until an upgrade is performed, administrators should restrict API exposure and monitor logs for unusual patterns in processing folder configurations that reference unexpected storage paths.