CVE-2025-55151 Stirling-PDF SSRF vulnerability on /api/v1/convert/file/pdf
Attackers can exploit SSRF in the PDF conversion endpoint to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-55151?
CVE-2025-55151 is a high-severity server-side request forgery vulnerability in Stirling-Tools Stirling-PDF, published on 11 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, the "convert file to pdf" functionality (/api/v1/convert/file/pdf) uses LibreOffice's unoconvert tool for conversion, and SSRF vulnerabilities exist during the conversion process. This issue has been patched in version 1.1.0.
Weakness: CWE-918
Which versions are affected by CVE-2025-55151?
It affects 1 product.
Products include Stirlingpdf Stirling Pdf.
How do I fix CVE-2025-55151?
No fix has been published for CVE-2025-55151 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-55151 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55151 exists.
Other vulnerabilities in Stirling-Tools Stirling-PDF
- CVE-2025-55150 Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf
- CVE-2025-55161 Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf
- CVE-2025-46568 Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability
- CVE-2026-33436 Stirling-PDF: Reflected XSS through crafted filename in file upload functionality
- CVE-2024-9075 Stirling-Tools Stirling-PDF Markdown-to-PDF cross site scripting
Sources
Also known as GHSA-76hv-h7g2-xfv3.