CVE-2026-33436: XSS in Stirling-PDF 1.0.0 < 2.0.0

The primary impact of CVE-2026-33436 is the potential for reflected XSS attacks. An attacker could upload a file with a malicious filename containing JavaScript code. When a user views the uploaded file, the JavaScript code will execute within their browser context. This could allow the attacker to steal session cookies, redirect the user to a malicious website, or deface the application. Given Stirling-PDF's function as a PDF processing tool, successful exploitation could also lead to the exfiltration of sensitive data contained within the processed PDF files, depending on user permissions and application configuration. The blast radius is limited to users interacting with the vulnerable file upload endpoints.

1. Reserved2026-03-19
2. Published2026-04-17
3. Modified2026-04-20
4. EPSS updated2026-04-25

The primary mitigation for CVE-2026-33436 is to upgrade Stirling-PDF to version 2.0.0 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing input validation and sanitization on all file upload endpoints to prevent the injection of malicious characters into the HTML output. Web Application Firewalls (WAFs) can be configured to detect and block requests containing suspicious filenames. Regularly review and update the application's security configuration to minimize the attack surface. After upgrading, confirm the fix by attempting to upload a file with a known malicious filename and verifying that the JavaScript code does not execute.