CVE-2026-113606: Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Stirling-PDF user can exploit it. The attacker does not need interaction from the victim and can target another user's server-side storage directory by supplying that user's identifier in a processing-folder request.
What access can an attacker obtain through the vulnerable processing-folder feature?
An attacker can list files belonging to other users and run pipelines against them. This can allow reading, modifying, or destroying the targeted users' stored files.
Is a default installation affected?
The available information identifies affected versions 3.0.0 through 3.2.0, but it does not state whether any particular default configuration enables or restricts processing folders. Exposure depends on authenticated users being able to create processing folders through the API.
What can be done if upgrading is not immediately possible?
The provided information does not document an official mitigation. Restrict access to authenticated accounts as much as possible and prevent untrusted users from creating processing folders or reaching the processing-folder API if those controls are available in the deployment.