CVE-2026-113606: Authorization Bypass Through User-Controlled Key in Stirling-Tools Stirling-PDF
Description
Stirling-PDF versions 3.0.0 through 3.2.0 have an authorization bypass vulnerability that allows authenticated users to access and manipulate other users' stored files. This occurs by creating a processing folder that points to the server storage directory of a victim user, enabling unauthorized file listing, reading, modification, or deletion.
CVSS v4.0
Score 7.1high
Affected software
Stirling-Tools
Stirling-PDF
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-113606 describes an authorization bypass vulnerability in Stirling-PDF versions 3.0.0 through 3.2.0. Authenticated users can exploit this flaw by sending a POST request to /api/v1/processing-folders with a folder path targeting storage/<victimUserId>. This allows them to access the victim's stored files, list them, and run processing pipelines that can read, modify, or destroy those files. The vulnerability arises from insufficient access controls on user-controlled keys that specify processing folder locations.
Potential Impact
An attacker with valid authentication can bypass authorization controls to access and manipulate files belonging to other users on the server. This can lead to unauthorized disclosure, modification, or destruction of sensitive data stored by other users.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to prevent creation of processing folders pointing to other users' storage directories.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-20T11:48:58.244Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad78d892cdf04f6563d7702
Added to database: 10/20/2026, 15:49:29 UTC
Last enriched: 10/20/2026, 16:03:31 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.