# CVE-2024-52286: Self Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDF

> Attackers can execute JavaScript via malicious filenames in Stirling-PDF's merge feature, potentially enabling phishing or session hijacking.

- **Severity:** Low 2.0 (`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** No
- **Published:** 11 Nov 2024
- **Updated:** 9 Jan 2025
- **Also known as:** GHSA-9j55-gvf2-cqwv

## What is CVE-2024-52286?

CVE-2024-52286 is a low-severity cross-site scripting vulnerability in Stirling-Tools Stirling-PDF, published on 11 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

### Official description

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes untrusted user input (file name) and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code in the context of the user. The issue stems to the code starting at `Line 24` in `src/main/resources/static/js/merge.js`. The file name is directly being input into InnerHTML with no sanitization on the file name, allowing a malicious user to be able to upload files with names containing HTML tags. As HTML tags can include JavaScript code, this can be used to execute JavaScript code in the context of the user. This is a self-injection style attack and relies on a user uploading the malicious file themselves and it impact only them, not other users. A user might be social engineered into running this to launch a phishing attack. Nevertheless, this breaks the expected security restrictions in place by the application. This issue has been addressed in version 0.32.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation), CWE-20 (Improper Input Validation)

## Which versions are affected by CVE-2024-52286?


## How do I fix CVE-2024-52286?

No fix has been published for CVE-2024-52286 yet. Limit exposure of the affected software until one is available.

## Is CVE-2024-52286 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52286 exists.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2024-52286 and fix it if it is affected.

What it is: CVE-2024-52286 is a low-severity cross-site scripting vulnerability in Stirling-Tools Stirling-PDF, published on 11 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52286 exists.

Affected product: Stirling-Tools Stirling-PDF. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2024-52286/ (Markdown: https://insights.sbomify.com/CVE-2024-52286/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2024-52286
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-52286
- OSV: https://osv.dev/vulnerability/CVE-2024-52286

---
From sbomify Insights: https://insights.sbomify.com/CVE-2024-52286/
Summaries are generated and may contain mistakes; the official description above is the record.