CVE-2026-71270: Stirling-Tools Stirling-PDF

High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days.

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf).

Affected products

• Stirling-Tools Stirling-PDF: any version

Published 2026-08-05. Last modified 2026-08-26.