CVE-2026-113606

7.1High

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity
Weakness: CWE-639

Impact

Authenticated users can read, modify, or delete other users' stored files. To exploit this, an attacker only needs a standard authenticated account on the instance.

Root cause

The processing folders endpoint fails to validate folder paths, allowing users to point custom processing folders directly to other users' storage paths (storage/<victimUserId>).

Affected systems

Stirling-PDF 3.0.0 through 3.2.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Fix & remediation

Upgrade to a version newer than 3.2.0 when available. If patching must wait, restrict user access to the POST /api/v1/processing-folders endpoint via reverse proxy or temporarily disable multi-user processing folder workflows.

shell

$ docker pull froodle/s-pdf:latest && docker compose up -d

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-113606