CVE-2025-46568: Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability
First published: Thu May 01 2025(Updated: )
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerable to SSRF-induced arbitrary file read. WeasyPrint redefines a set of HTML tags, including img, embed, object, and others. The references to several files inside, allow the attachment of content from any webpage or local file to a PDF. This allows the attacker to read any file on the server, including sensitive files and configuration files. All users utilizing this feature will be affected. This issue has been patched in version 0.45.0.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Stirling PDF | <0.45.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-46568?
The severity of CVE-2025-46568 is classified as high due to its potential for arbitrary file read exploitation.
How do I fix CVE-2025-46568?
To fix CVE-2025-46568, upgrade Stirling-PDF to version 0.45.0 or later.
What type of vulnerability is CVE-2025-46568?
CVE-2025-46568 is a server-side request forgery (SSRF) vulnerability.
What impacts does CVE-2025-46568 have on affected systems?
CVE-2025-46568 allows attackers to read arbitrary files on the server, potentially exposing sensitive information.
Who is affected by CVE-2025-46568?
CVE-2025-46568 affects all users of Stirling-PDF versions prior to 0.45.0.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/source
- agent/epss
- agent/tags
- vendor/stirling
- canonical/stirling pdf