Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-113606Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in Stirling-PDF from Stirling-Tools. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 69.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.

Affected products (as reported)

Vendor	Product	Versions
Stirling-Tools	Stirling-PDF	3.0.0 – through 3.2.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References

https://github.com/abraxas/stirling-storage-folder-idor exploit, technical-description
https://abraxaslabs.tech/research/stirling-storage-folder-idor technical-description
https://abraxaslabs.tech/research/stirling-pdf-3.2.0-leftovers technical-description
https://github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java technical-description
https://github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/ProcessingFolderController.java technical-description
VulnCheck Advisory: Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders third-party-advisory