Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protecti…

CVE-2026-71270 affects Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java), which was not updated with the SSRF protections applied to sibling conversion endpoints. The endpoint only validates that the initial URL resolves to a public IP, but then fetches the page HTML server-side without sanitization and passes it to a WeasyPrint subprocess. Embedded resource references within the fetched HTML, such as image tags pointing to cloud metadata endpoints like 169.254.169.254, are fetched by WeasyPrint without any per-resource SSRF filtering. This allows an attacker-controlled web page to cause the server to retrieve internal network resources or cloud metadata endpoints. The contents of those internal resources are then leaked back to the attacker via the generated PDF output. Three sibling endpoints (html/pdf, file/pdf, markdown/pdf) had already received CustomHtmlSanitizer and SsrfProtectionService protections, making this an inconsistent security implementation.