The Stirling-PDF product from Stirling-Tools contains an SSRF vulnerability identified as CWE-918. Specifically, the POST /api/v1/convert/url/pdf endpoint (implemented in ConvertWebsiteToPDF.java) was not updated to include the CustomHtmlSanitizer and SsrfProtectionService protections that were added to three other conversion endpoints (html/pdf, file/pdf, markdown/pdf). This inconsistency leaves this endpoint vulnerable to SSRF attacks, which can lead to unauthorized access to internal resources or sensitive information. The CVSS v3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high confidentiality impact.

An attacker can exploit this SSRF vulnerability to make the server perform unauthorized requests, potentially accessing sensitive internal resources or data. The impact affects confidentiality with no direct impact on integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the vulnerable endpoint or implementing network-level controls to limit outbound requests from the server.