Stirling-PDF: Reflected XSS through crafted filename in file upload functionality

The primary impact of CVE-2026-33436 is the potential for reflected XSS attacks. An attacker could upload a file with a malicious filename containing JavaScript code. When a user views the uploaded file, the JavaScript code will execute within their browser context. This could allow the attacker to steal session cookies, redirect the user to a malicious website, or deface the application. Given Stirling-PDF's function as a PDF processing tool, successful exploitation could also lead to the exfiltration of sensitive data contained within the processed PDF files, depending on user permissions and application configuration. The blast radius is limited to users interacting with the vulnerable file upload endpoints.

Organizations using Stirling-PDF for local PDF processing, particularly those with user-facing file upload functionality, are at risk. Shared hosting environments where multiple users have access to the same Stirling-PDF instance are especially vulnerable, as a malicious file uploaded by one user could impact other users.

• php: Examine application logs for unusual file upload activity, specifically looking for filenames containing JavaScript code (e.g., <script>alert('XSS')</script>). • generic web: Use curl to test file upload endpoints with malicious filenames and observe the response HTML for signs of JavaScript execution.

curl -X POST -F "file=@malicious_file.pdf" http://your-stirling-pdf-instance/upload.php

• generic web: Inspect the source code of file upload handling functions for inadequate sanitization of filenames before rendering them in HTML.

1. 2026-04-17Disclosure

   disclosure

1. आरक्षित2026-03-19
2. प्रकाशित2026-04-17
3. संशोधित2026-04-20
4. EPSS अद्यतन2026-04-25

The primary mitigation for CVE-2026-33436 is to upgrade Stirling-PDF to version 2.0.0 or later, which contains the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing input validation and sanitization on all file upload endpoints to prevent the injection of malicious characters into the HTML output. Web Application Firewalls (WAFs) can be configured to detect and block requests containing suspicious filenames. Regularly review and update the application's security configuration to minimize the attack surface. After upgrading, confirm the fix by attempting to upload a file with a known malicious filename and verifying that the JavaScript code does not execute.