CVE-2026-113605

Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.

Affected

Stirling-Tools · Stirling-PDF

CVSS v4.0 VULNCHECK

8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.66% chance of exploitation in the next 30 days, 52nd percentile

Published

2026-10-20

Proof-of-concept exploits (1)

• abraxas/stirling-h2-import-leftoverRepo stars 1★ · pushed 2026-10-17 · find archive

CVE references

• https://abraxaslabs.tech/research/stirling-h2-import-leftoverREFERENCE
• https://abraxaslabs.tech/research/stirling-pdf-3.2.0-leftoversREFERENCE
• Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/p…REFERENCE
• https://www.vulncheck.com/advisories/stirling-pdf-2.13.2-through-3.2.0-h2-sql-denylist-by…REFERENCE

References

• CVE Record
• NVD entry