High 7.1Published Oct 20, 2026

CVE-2026-113606Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders

Updated under an hour ago (Oct 28, 2026, 8:50 AM ET)

Does this affect you?

It affects Stirling-Tools Stirling-PDF. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.36%, higher than 30% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Stirling-Tools Stirling-PDF

Exploited in the last 30 days

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Weakness (CWE): CWE-639
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.36% (percentile 30)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 22, 2026
First seen by InfoSec Signals: Oct 20, 2026

Affected products

Affected products

Stirling-Tools Stirling-PDF stirling_tools:stirling_pdf (from the name)	from 3.0.0 through 3.2.0	CNA record

References

References

https://github.com/abraxas/stirling-storage-folder-idor	exploit, technical-description
https://abraxaslabs.tech/research/stirling-storage-folder-idor	technical-description
https://abraxaslabs.tech/research/stirling-pdf-3.2.0-leftovers	technical-description
https://github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java	technical-description
https://github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/ProcessingFolderController.java	technical-description
https://www.vulncheck.com/advisories/stirling-pdf-3.0.0-through-3.2.0-authorization-bypass-via-processing-folders	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.