Live › vulnerability › CVE-2026-113605
Go to dashboardStirling-PDF 2.13.2 to 3.2.0: the import-database denylist in DatabaseService.validateSqlContent() blocks CREATE ALIAS but not CREATE OR REPLACE ALIAS. A ROLE_ADMIN who uploads a crafted SQL backup can define H2 Java function aliases and run Java methods on the server. Public PoC (lab proved the alias import; host file read and RCE are inferred from the earlier CVE-2026-85714, not lab-proven). Needs admin credentials; the default first admin is admin/stirling until changed. Only the fat/with-login build with the default embedded H2 is affected: the lite build lacks the controller and a custom PostgreSQL datasource disables it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Stirling-PDF | github | >= 2.13.2, <= 3.2.0 | – |
2.13.2 to 3.2.0 and you are in range3.2.1 release notes do not mention it, so verify against the vendor advisory GHSA-j8f5-2f4f-jm2m before relying on itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-113605")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.