CyberRota Analysis
AI-GeneratedThe Stirling-PDF application prior to version 2.0.0 is vulnerable to stored cross-site scripting (XSS) due to improper handling of untrusted PDF Title and Author metadata in its Get Info workflow. This vulnerability allows attackers to execute malicious scripts, potentially accessing sensitive browser-session data or altering page content when users interact with the application. Organizations using versions before 2.0.0 should prioritize updating to the latest version to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to access browser-session data or modify page content. This issue is fixed in version 2.0.0.