CVE-2026-33436

Stirling-PDF, a locally hosted web application for PDF file operations, contains a reflected cross-site scripting (XSS) vulnerability in versions prior to 2.0.0. The flaw exists in multiple file upload endpoints that render user-supplied filenames directly into HTML without sanitization, allowing attackers to inject malicious JavaScript through crafted filenames. The vulnerability has been remediated in version 2.0.0. The attack requires network access and user interaction, with a CVSS score of 3.1 (LOW) reflecting limited impact—specifically low confidentiality risk with no integrity or availability impact. The attack vector is network-based but demands high attack complexity and user action to execute. An attacker would need to trick a user into uploading a specially crafted file with a malicious filename to trigger the XSS payload in that user's browser. The vulnerability is not currently being exploited in the wild and does not appear on the CISA Known Exploited Vulnerabilities catalog. No public exploit code is readily available, and community attention remains minimal, as evidenced by its inactive status on threat tracking lists. Organizations should prioritize upgrading to version 2.0.0 as a routine security maintenance measure.