CVE-2025-55161: Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55161?
CVE-2025-55161 is classified as a high severity vulnerability due to the potential for arbitrary code execution through the affected endpoint.
How do I fix CVE-2025-55161?
To mitigate CVE-2025-55161, upgrade Stirling-PDF to version 1.1.0 or later where the vulnerability has been addressed.
What versions of Stirling-PDF are affected by CVE-2025-55161?
CVE-2025-55161 affects all versions of Stirling-PDF prior to 1.1.0.
What is the impact of CVE-2025-55161?
The impact of CVE-2025-55161 includes potential execution of malicious code on the server through untrusted Markdown input.
Is there a known exploit for CVE-2025-55161?
As of now, there are no publicly disclosed exploits for CVE-2025-55161, but the vulnerability's nature suggests that it could be leveraged for attacks.