Description

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subrequests, allowing an authenticated ROLE_USER to retrieve the key through /api/v1/user/get-api-key, impersonate the internal service account, bypass normal rate limits, and access internal endpoints including /api/v1/info/requests/all and /api/v1/info/load/all. This issue is fixed in version 2.9.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-17T20:16:44.587Z",
  "pubdate": "2026-08-17T20:16:44.587Z",
  "executiveSummary": "An information disclosure and privilege escalation vulnerability exists in Stirling-PDF prior to version 2.9.0, specifically within the pipeline processing subsystem. The flaw involves the insecure handling and injection of the STIRLING-PDF-BACKEND-API-USER API key during pipeline subrequests handled by the /api/v1/pipeline/handleData endpoint. Authenticated users with ROLE_USER privileges can exploit this behavior to retrieve the administrative backend API key via the /api/v1/user/get-api-key endpoint. Successful exploitation enables an attacker to impersonate the internal service account, bypass application-level rate limits, and gain unauthorized access to restricted internal administrative endpoints, including /api/v1/info/requests/all and /api/v1/info/load/all. The risk implication is significant as it compromises internal access controls and service account integrity. The attack vector requires authenticated access with minimal ROLE_USER privileges against locally hosted web application deployments.",
  "technicalDetails": "The vulnerability resides in the PipelineProcessor controller component of Stirling-PDF, specifically located at app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java. Prior to version 2.9.0, the root cause of the issue stems from the application logic within the /api/v1/pipeline/handleData endpoint injecting the sensitive STIRLING-PDF-BACKEND-API-USER API key directly into pipeline subrequests.\nThe attack flow proceeds as follows: First, an authenticated threat actor possessing standard ROLE_USER privileges interacts with the pipeline functionality, triggering subrequests processed by the vulnerable endpoint. Due to the insecure key injection mechanism, the backend API key becomes exposed or retrievable. The attacker then queries the /api/v1/user/get-api-key endpoint to extract the STIRLING-PDF-BACKEND-API-USER API key. Armed with this high-privilege internal API key, the attacker crafts subsequent HTTP requests incorporating the stolen credentials.\nBy authenticating with the internal service account credentials, the attacker successfully bypasses standard rate-limiting controls enforced on regular user sessions. Furthermore, the attacker gains unauthorized access to privileged internal endpoints that are otherwise restricted, specifically /api/v1/info/requests/all and /api/v1/info/load/all, leading to unauthorized information disclosure regarding system requests and load metrics. The affected product is Stirling-PDF across versions prior to 2.9.0. Exploitation requires network access to the locally hosted web application, valid user authentication (ROLE_USER), and interaction with the pipeline processing and user API key retrieval endpoints."
}