CVE-2026-27625

CVE-2026-27625 is a path traversal vulnerability affecting Stirling-PDF versions prior to 2.5.2, specifically within the /api/v1/convert/markdown/pdf endpoint. An authenticated attacker can exploit this flaw to achieve arbitrary file write with the privileges of the Stirling-PDF process user, potentially compromising data integrity. Rated as Medium severity (CVSS 6.5), the vulnerability has a network attack vector, low complexity, and requires only low privileges. This allows files to be written outside the intended temporary directory, with further impact depending on writable paths. There is currently no evidence of active exploitation, public exploit code, or significant community attention for this vulnerability.