CVE-2026-34071 MEDIUM

CVE-2026-34071: Stirling-PDF has Stored Cross Site Scripting (XSS) via EML-to-HTML Export

Vendor Stirling-Tools
Product Stirling-PDF
Weakness CWE-79 · XSS
Published March 26, 2026
Last update March 26, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In version 2.7.3, the /api/v1/convert/eml/pdf endpoint with parameter downloadHtml=true returns unsanitized HTML from the email body with Content-Type: text/html. An attacker who sends a malicious email to a Stirling-PDF user can achieve JavaScript execution when that user exports the email using the "Download HTML intermediate file" feature. Version 2.8.0 fixes the issue.

Key dates

02Disclosure timeline

March 26, 2026 CVE published
March 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-10343 Beek Widget Extention <= 0.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-43719 Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS) CVE-2024-7684 SourceCodester Kortex Lite Advocate Office Management System add_act.php cross site scripting CVE-2024-23640 GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher CVE-2022-37335 WordPress Word Search Puzzles game plugin <= 2.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability