CVE-2026-113605
Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
Stirling-Tools Stirling-PDF
CVSS
8.6HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 20 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.66%Chance of exploitation activity in the next 30 days, higher than 51% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.
Text from CVE List
Affected versions 1
- Stirling-PDFaffected: 2.13.2 through 3.2.0CVE List
References 5
- github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/security/service/DatabaseService.javaAdvisoryvia CVE List
- vulncheck.com/advisories/stirling-pdf-2.13.2-through-3.2.0-h2-sql-denylist-bypass-via-import-databaseAdvisoryvia CVE List
- github.com/abraxas/stirling-h2-import-leftoverExploitvia CVE List
- abraxaslabs.tech/research/stirling-h2-import-leftoverReferencevia CVE List
- abraxaslabs.tech/research/stirling-pdf-3.2.0-leftoversReferencevia CVE List