HIGH
CVE-2026-71270
CVSS
8.6
Description
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf).
Weakness (CWE)
CWE-918
Server-Side Request Forgery (SSRF)
EPSS Score
0.31%
Probability of exploitation in next 30 days
24.4th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.