7.2
HighCVSS 3.1 · from VulnCheck
CVE-2026-113605
Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
Stirling-PDF · CWE-184 · CWE-184AffectedStirling-PDF
FixNo fix listed yet.
PublishedOct 20, 15:40 · VulnCheck
ScoredOct 20 · 7.2 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inStirling-PDF2.13.2 – 3.2.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known