CVE-2026-27625 Stirling-PDF Zip Slip: Arbitrary File Write via Path Traversal in Markdown-to-PDF ZIP Extraction
Authenticated users can exploit path traversal in ZIP extraction to write arbitrary files, potentially compromising data integrity or executing code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27625?
CVE-2026-27625 is a high-severity path traversal vulnerability in Stirling-Tools Stirling-PDF, published on 20 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Stirling-PDF is a locally hosted web application that performs various operations on PDF files. In versions prior to 2.5.2, the /api/v1/convert/markdown/pdf endpoint extracts user-supplied ZIP entries without path checks. Any authenticated user can write files outside the intended temporary working directory, leading to arbitrary file write with the privileges of the Stirling-PDF process user (stirlingpdfuser). This can overwrite writable files and compromise data integrity, with further impact depending on writable paths. The issue was fixed in version 2.5.2.
Which versions are affected by CVE-2026-27625?
It affects 1 product.
Products include Stirling Stirling Pdf.
How do I fix CVE-2026-27625?
No fix has been published for CVE-2026-27625 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-27625 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27625 exists.
Other vulnerabilities in Stirling-Tools Stirling-PDF
Sources
Also known as GHSA-wccq-mg6x-2w22.