VulnSocial

CVE-2026-27625Disclosure(stirling / stirling_pdf)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZIP entries without path checks. Any authenticated user can write files outside the intended temporary working directory, leading to arbitrary file write with the privileges of the Stirling-PDF process user (stirlingpdfuser). This can overwrite writable files and compromise data integrity, with further impact depending on writable paths. The issue was fixed in version 2.5.2.

stirling CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Weakness type (CWE)
CWE-22CWE-23

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • stirling_pdf

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-03-20); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
stirling
Products
stirling_pdf

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-20: 2Mentions · 2026-03-22: 1Technical Details · 2026-03-20: 1Technical Details · 2026-03-22: 103-2003-22
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-03-202
Disclosure1General1
2026-03-221
Disclosure1
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-27625 Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint … https://www.cve.org/CVERecord?id=CVE-2026-27625

    Post summary

    The post announces a vulnerability in Stirling‑PDF’s markdown‑to‑PDF endpoint affecting versions before 2.5.2, but offers no PoC, exploit details, or patch information.

    00000117
    56.8K followersView on X
  • The Hacker Wire@TheHackerWire
    General

    🟠 CVE-2026-27625 - High Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZI... https://www.thehackerwire.com/vulnerability/CVE-2026-27625/ https://t.co/WwMbIkNl3D

    Post summary

    The tweet reports CVE‑2026‑27625 in Stirling‑PDF with a high severity rating and notes an affected endpoint, but it does not provide a PoC, exploit code, active exploitation evidence, patch, or detailed technical information.

    0000045
    138 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-27625 Authenticated Arbitrary File Write Vulnerability in Stirling-PDF Before 2.5.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27625

    Post summary

    The text announces CVE‑2026‑27625 as an authenticated arbitrary file write vulnerability affecting Stirling‑PDF versions prior to 2.5.2, referencing a Vulmon vulnerability details page.

    0000042
    4.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appstirlingstirling_pdf---

Explore more

Back to dashboardstirling CVEsstirling_pdf vulnerabilities