CVE-2026-71270 in Stirling-PDF
Summary
by MITRE • 08/05/2026
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf). The endpoint validates only that the initial requested URL resolves to a public IP, then fetches the page's HTML server-side and hands it, unsanitized, to a WeasyPrint subprocess. Embedded resource references in the fetched HTML (e.g. `<img src="http://169.254.169.254/...">`) are fetched by WeasyPrint with no per-resource SSRF filtering, allowing an attacker-controlled page to cause the server to retrieve cloud metadata endpoints or internal network resources and leak their contents back into the generated PDF.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/05/2026
The vulnerability in Stirling-PDF's POST /api/v1/convert/url/pdf endpoint represents a critical server-side request forgery flaw that undermines fundamental security protections implemented for similar conversion functionalities within the same application. This endpoint fails to incorporate the SSRF safeguards that were rigorously applied to three sibling conversion endpoints including html/pdf, file/pdf, and markdown/pdf, creating an exploitable inconsistency in the application's security posture. The vulnerability stems from inadequate input validation where the system only verifies that the initial requested URL resolves to a public IP address without implementing comprehensive sanitization of embedded resource references within the fetched HTML content.
The technical implementation flaw manifests through the endpoint's failure to sanitize dynamic content before passing it to the WeasyPrint subprocess, which operates with elevated privileges and fetches all embedded resources without proper filtering mechanisms. This design allows attackers to craft malicious web pages containing embedded references to internal network endpoints such as cloud metadata services at 169.254.169.254 or other sensitive internal resources. The WeasyPrint subprocess processes these embedded references directly without any per-resource SSRF protection, enabling unauthorized access to internal systems that would normally be protected by network segmentation and firewall rules.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with a sophisticated method for bypassing network security controls and accessing sensitive internal resources. The attack vector leverages the server's legitimate ability to fetch remote content while exploiting the lack of proper resource filtering to retrieve data from cloud metadata services, internal APIs, or other protected endpoints that typically remain inaccessible from external networks. This creates a significant risk for organizations relying on Stirling-PDF for document conversion services, particularly in cloud environments where metadata endpoints contain sensitive operational information including instance IDs, security credentials, and network configuration details.
The vulnerability directly maps to CWE-918 Server-Side Request Forgery and aligns with ATT&CK technique T1566.002 Initial Access: Phishing via Service Provider, though in this case the attack occurs through legitimate API endpoints rather than user interaction. The security gap demonstrates a critical failure in maintaining consistent security controls across application components, where protective measures were selectively applied to similar functionalities. Organizations should implement comprehensive SSRF protection mechanisms that validate all resource references within fetched content, regardless of the original endpoint's security posture, and ensure that all subprocess calls receive properly sanitized input to prevent unauthorized network access patterns.
Mitigation strategies must include immediate implementation of the same CustomHtmlSanitizer and SsrfProtectionService protections that were applied to the sibling endpoints, ensuring consistent security controls across all conversion paths. The system should validate all embedded resource references within fetched HTML content against a whitelist of allowed domains or IP ranges, while implementing proper network segmentation to prevent access to internal resources from the WeasyPrint subprocess. Additionally, organizations should conduct comprehensive security audits to identify similar inconsistencies in other application endpoints and establish automated testing procedures to verify that security controls remain consistent across all similar functionalities.