CVE-2025-55161CWE-918

Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf

High · published August 11, 2025

CVSS v3.1
8.6
EPSS
2%
Percentile
80.6
In the wild
Unconfirmed
What it is

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01999 · 80.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-08-11T22:28Z
EPSS history
Timeline
  • 11 AUG 22:28Z
    Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf
    cvelistv5