CVE-2025-46568

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. Prior to version 0.45.0, Stirling-PDF is vulnerable to SSRF-induced arbitrary file read. WeasyPrint redefines a set of HTML tags, including img, embed, object, and others. The references to several files inside, allow the attachment of content from any webpage or local file to a PDF. This allows the attacker to read any file on the server, including sensitive files and configuration files. All users utilizing this feature will be affected. This issue has been patched in version 0.45.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
May 1, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-465697.4Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP CVE-2025-46576.7A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, LenCVE-2025-465702.6vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.9.0, when a new prompt is processed, if the PagCVE-2025-465715.4Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged usCVE-2025-465729.3passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to CVE-2025-465738.6passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to CVE-2025-465745.3There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the systemCVE-2025-465757.5There is an information disclosure vulnerability in the GoldenDB database product. Attackers can exploit error messages to obtain the systemCVE-2025-465766.5There is a Permission Management and Access Control vulnerability in the GoldenDB database product. Attackers can manipulate requests to bypCVE-2025-465777.5There is a SQL injection vulnerability in the GoldenDB database product. Attackers can inject commands to extract database information.CVE-2025-465787.5There are SQL injection vulnerabilities in multiple interfaces of the GoldenDB database product. Attackers can exploit these interfaces to iCVE-2025-465797.8There is a DDE injection vulnerability in the GoldenDB database product. Attackers can inject DDE expressions through the interface, and whe