CVE-2026-113605: Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Stirling-PDF administrator can exploit it. The attacker needs access to the import-database endpoint and the ability to upload a crafted SQL backup.
What does successful exploitation allow?
A crafted backup can use RUNSCRIPT with CREATE OR REPLACE ALIAS to define H2 Java function aliases. This restores Java-method execution, with high confidentiality, integrity, and availability impact.
Are installations outside the listed versions affected?
The provided affected range is Stirling-PDF 2.13.2 through 3.2.0. No information is provided about versions before 2.13.2 or after 3.2.0.
What can be done if an update cannot be applied immediately?
Restrict administrator access and prevent untrusted administrators from accessing the import-database endpoint or uploading SQL backups. The exploit requires an authenticated administrator and a crafted import file.