CVE-2026-57485

Stirling-PDF versions prior to 2.9.0 contain an API key disclosure vulnerability in the /api/v1/pipeline/handleData endpoint (PipelineProcessor.java). The endpoint injects the STIRLING-PDF-BACKEND-API-USER key into pipeline subrequests, which an authenticated ROLE_USER can retrieve via /api/v1/us...

CVE-2026-57485 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...