CVE-2024-52286

CVE-2024-52286 describes a self-injection cross-site scripting (XSS) vulnerability in Stirling-PDF versions prior to 0.32.0, specifically within its Merge functionality. An unauthenticated attacker can embed JavaScript code in a malicious filename, which executes when a user uploads and processes that file. While this attack primarily impacts the user who uploads the file, it breaks application security and could be used in social engineering or phishing campaigns. The vulnerability has a low CVSS score of 2.0, indicating a network attack vector with low complexity, requiring user interaction. There is no evidence of active exploitation, public exploit code, or significant community discussion beyond a single GitHub mention.