CVE-2026-41580: Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author)
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Stirling-PDFto a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41580?
The severity of CVE-2026-41580 is medium, rated at 6.1.
How do I fix CVE-2026-41580?
To fix CVE-2026-41580, upgrade to Stirling-PDF version 2.0.0 or later.
What is the impact of CVE-2026-41580?
CVE-2026-41580 allows reflected XSS attacks through unencoded PDF Title and Author metadata.
Which versions of Stirling-PDF are affected by CVE-2026-41580?
Versions of Stirling-PDF prior to 2.0.0 are affected by CVE-2026-41580.
What type of vulnerability is CVE-2026-41580 classified as?
CVE-2026-41580 is classified as a Cross-Site Scripting (XSS) vulnerability.