Stirling-PDF: Reflected XSS through crafted filename in file upload functionality

The primary impact of CVE-2026-33436 is the potential for reflected XSS attacks. An attacker could craft a malicious PDF file with a filename containing JavaScript code. When a user uploads this file through a vulnerable Stirling-PDF endpoint, the filename is rendered directly into the HTML output without proper sanitization. This allows the embedded JavaScript to execute within the user's browser, granting the attacker the ability to steal cookies, redirect the user to a malicious website, or deface the application. The blast radius is limited to users who interact with the vulnerable upload functionality, but the impact on individual users can be significant.

Organizations using Stirling-PDF for local PDF processing, particularly those with user-facing file upload functionality, are at risk. Shared hosting environments where multiple users have access to the same Stirling-PDF instance are especially vulnerable, as a malicious file uploaded by one user could impact other users.

• php: Examine application logs for unusual file upload activity, specifically looking for filenames containing JavaScript code (e.g., <script>alert('XSS')</script>). • generic web: Use curl to test file upload endpoints with malicious filenames and observe the response HTML for signs of JavaScript execution.

curl -X POST -F "file=@malicious_file.pdf" http://your-stirling-pdf-instance/upload.php

• generic web: Inspect the source code of file upload handling functions for inadequate sanitization of filenames before rendering them in HTML.

1. 2026-04-17Disclosure

   disclosure

1. Reserviert2026-03-19
2. Veröffentlicht2026-04-17
3. Geändert2026-04-20
4. EPSS aktualisiert2026-04-25

The recommended mitigation for CVE-2026-33436 is to immediately upgrade Stirling-PDF to version 2.0.0 or later, which includes a fix for the vulnerability. If upgrading is not immediately feasible, consider implementing input validation and sanitization on all file upload endpoints to prevent the injection of malicious characters. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review and audit all file upload processes to ensure proper sanitization techniques are employed.