CVE-2026-71270: Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf). The endpoint validates only that the initial requested URL resolves to a public IP, then fetches the page's HTML server-side and hands it, unsanitized, to a WeasyPrint subprocess. Embedded resource references in the fetched HTML (e.g. <img src="http://169.254.169.254/...">) are fetched by WeasyPrint with no per-resource SSRF filtering, allowing an attacker-controlled page to cause the server to retrieve cloud metadata endpoints or internal network resources and leak their contents back into the generated PDF.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update Stirling-PDF's ConvertWebsiteToPDF.java implementation for POST /api/v1/convert/url/pdf to apply the CustomHtmlSanitizer and SsrfProtectionService SSRF protections (not just the initial check that the requested URL resolves to a public IP), so server-side HTML fetching and WeasyPrint subprocess processing block per-resource SSRF to internal networks/cloud metadata.
Stirling-PDF POST /api/v1/convert/url/pdf SSRF protections via CustomHtmlSanitizer/SsrfProtectionService = Use the SSRF protections that were added to the sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf) for the ConvertWebsiteToPDF.java endpoint - Compensating control
Ensure per-resource SSRF filtering is enforced for resources fetched by the WeasyPrint subprocess from attacker-controlled HTML (e.g., block fetching of internal IPs like 169.254.169.254) to prevent leakage of cloud metadata or internal network resources into generated PDFs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71270?
CVE-2026-71270 has a severity rating of high with a score of 8.6.
How do I fix CVE-2026-71270?
To fix CVE-2026-71270, update the Stirling-PDF application to ensure all endpoints, including /api/v1/convert/url/pdf, implement the required SSRF protections.
What type of vulnerability is CVE-2026-71270?
CVE-2026-71270 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
What are the potential impacts of CVE-2026-71270?
The potential impacts of CVE-2026-71270 include unauthorized access to internal services and exposure of sensitive data.
Which software is affected by CVE-2026-71270?
CVE-2026-71270 affects the Stirling-PDF application that utilizes WeasyPrint for PDF conversion.