CVE-2026-34071: Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export
Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version 2.7.3, the /api/v1/convert/eml/pdf endpoint with parameter downloadHtml=true returns unsanitized HTML from the email body with Content-Type: text/html. An attacker who sends a malicious email to a Stirling-PDF user can achieve JavaScript execution when that user exports the email using the "Download HTML intermediate file" feature. Version 2.8.0 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34071?
CVE-2026-34071 is classified as a medium severity vulnerability due to its potential for Stored Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2026-34071?
To fix CVE-2026-34071, upgrade to Stirling-PDF version 2.8.0 or later, which includes patches against the vulnerability.
What specific vulnerability is addressed by CVE-2026-34071?
CVE-2026-34071 addresses a Stored Cross Site Scripting vulnerability in the EML-to-HTML export functionality of Stirling-PDF.
Which versions of Stirling-PDF are affected by CVE-2026-34071?
Stirling-PDF versions prior to 2.8.0 are affected by CVE-2026-34071.
What impact can CVE-2026-34071 have on users?
If exploited, CVE-2026-34071 can allow attackers to inject malicious scripts into sensitive data, potentially compromising user sessions and data integrity.