The vulnerability exists because the /api/v1/convert/url/pdf endpoint in Stirling-PDF does not implement the CustomHtmlSanitizer or SsrfProtectionService protections that other similar endpoints have. While it validates that the initial URL resolves to a public IP, it does not apply SSRF filtering to embedded resource references within the fetched HTML. Consequently, WeasyPrint fetches these embedded resources without restriction, enabling an attacker to craft malicious HTML that causes the server to access internal network resources or cloud metadata endpoints and include their content in the PDF output. This is classified as CWE-918 (Server-Side Request Forgery).

An attacker can exploit this vulnerability to induce the server to make unauthorized requests to internal or cloud metadata services, potentially leaking sensitive information such as cloud instance metadata. The CVSS score of 8.6 (High) reflects the network attack vector, low complexity, no privileges required, no user interaction, and a confidentiality impact of high. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the vulnerable /api/v1/convert/url/pdf endpoint or restrict its access. Monitor vendor communications for updates on official patches or mitigations.