CVE-2026-33436: Stirling-PDF: Reflected XSS through crafted filename in file upload functionality
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. In versions prior to 2.0.0, file upload endpoints render user-supplied filenames directly into HTML using unsafe methods like innerHTML without sanitization. An attacker can craft a file with a malicious filename containing JavaScript that executes in the uploading user's browser context, resulting in reflected XSS. The issue affects numerous upload endpoints across the application. The issue has been fixed in version 2.0.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33436?
CVE-2026-33436 has a medium severity rating due to its potential for reflected cross-site scripting (XSS).
How do I fix CVE-2026-33436?
To fix CVE-2026-33436, upgrade Stirling-PDF to version 2.0.0 or later, where the vulnerability is patched.
What is the impact of CVE-2026-33436?
The impact of CVE-2026-33436 allows attackers to execute arbitrary JavaScript in the context of the user's browser session through crafted filenames.
Who is affected by CVE-2026-33436?
Users running Stirling-PDF versions before 2.0.0 are affected by CVE-2026-33436 due to vulnerable file upload functionality.
Is CVE-2026-33436 easy to exploit?
CVE-2026-33436 can be exploited easily by an attacker who can manipulate the file upload feature to include malicious scripts.