{"id":"CVE-2026-113605","kind":"vulnerability","aliases":["CVE-2026-113605"],"related":[],"title":"Stirling-PDF: admin SQL import bypass lets uploaded backup run Java code","description":"Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.","summary":"Stirling-PDF 2.13.2 to 3.2.0: the import-database denylist in DatabaseService.validateSqlContent() blocks CREATE ALIAS but not CREATE OR REPLACE ALIAS. A ROLE_ADMIN who uploads a crafted SQL backup can define H2 Java function aliases and run Java methods on the server. Public PoC (lab proved the alias import; host file read and RCE are inferred from the earlier CVE-2026-85714, not lab-proven). Needs admin credentials; the default first admin is admin/stirling until changed. Only the fat/with-login build with the default embedded H2 is affected: the lite build lacks the controller and a custom PostgreSQL datasource disables it.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Stirling-PDF","fixed":[],"affected":">= 2.13.2, <= 3.2.0","ecosystem":"github"}],"ecosystems":[],"tags":["docker","h2","java","package","self-hosted","stirling-pdf"],"not_affected_if":["auth-required","default-config","lite-build","no-admin-access","postgresql-datasource"],"how_to_check":"Run a version 2.13.2 to 3.2.0 and you are in range. Check with the Docker image tag (e.g. stirlingtools/stirling-pdf:3.2.0-fat) or the version shown in the app. Exposed only if login is enabled, the default embedded H2 database is used, and the fat/proprietary build is running. Check that the admin password is not the default admin/stirling, and who holds ROLE_ADMIN.","fix":"No confirmed fixed version: the 3.2.1 release notes do not mention it, so verify against the vendor advisory GHSA-j8f5-2f4f-jm2m before relying on it. Until then: restrict admin accounts, change the default admin password, keep the admin UI off the public internet. Upstream fix suggested by the researcher: change the denylist regex to (?i)\\bCREATE\\s+(OR\\s+REPLACE\\s+)?(FORCE\\s+)?ALIAS\\b and validate the same bytes RUNSCRIPT executes.","status":"open","published_at":"2026-10-20T16:17:10+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:38+00:00","updated_at":"2026-10-24T00:13:56+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-10-23T22:39:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Stirling-PDF: admin SQL import bypass lets uploaded backup run Java code","impact":"high","summary":"Stirling-PDF versions 2.13.2 through 3.2.0 filter SQL on database import with an incomplete denylist. An administrator can upload a crafted SQL backup that defines H2 Java function aliases and gets Java method execution on the server.","category":"package","who_cares":["stirling-pdf","self-hosted","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary Java code on the server as an admin","analyst_note":"Check the NVD page for a fixed version and whether the import-database endpoint is reachable by non-admins; confirm the affected range 2.13.2 to 3.2.0 against the upstream release notes.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000482,"input_tokens":2972,"output_tokens":369,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD page for a fixed version and whether the import-database endpoint is reachable by non-admins; confirm the affected range 2.13.2 to 3.2.0 against the upstream release notes.","search":"'-113605':16A,19A '-2026':15A,18A,95B '-85714':96B '2.13.2':36B,139C '3.2.0':38B,141C 'admin':4A,57B,102B,107B 'admin/stirling':109B 'administr':150C,162C 'affect':122B 'alia':48B,54B,82B,160C 'alias':69B,181C 'allow':149C 'authent':161C 'backup':10A,63B,168C 'block':46B 'build':115B,125B 'bypass':7A,152C 'chang':111B 'code':13A 'contain':142C 'control':128B 'craft':61B,166C 'creat':47B,51B,157C 'credenti':103B 'custom':131B 'cve':14A,17A,94B 'databas':42B,173C 'databaseservice.validatesqlcontent':45B,147C 'datasourc':133B 'default':105B,118B 'defin':65B,177C 'denylist':43B,145C 'disabl':134B 'docker':23B 'earlier':93B 'embed':119B 'endpoint':174C 'execut':187C 'fat/with-login':114B 'file':85B 'first':106B 'function':68B,180C 'h2':24B,66B,120B,153C,178C 'host':29B,84B 'import':6A,41B,83B,154C,172C 'import-databas':40B,171C 'incomplet':144C 'infer':90B 'java':12A,25B,67B,72B,179C,185C 'java-method':184C 'lab':79B,99B 'lab-proven':98B 'lack':126B 'let':8A 'lite':124B 'method':73B,186C 'need':101B 'packag':26B 'pdf':3A,22A,32B,35B,137C 'poc':78B 'postgresql':132B 'prove':80B 'proven':100B 'public':77B 'rce':88B 'read':86B 'replac':53B,159C 'restor':183C 'restrict':155C 'role':56B 'run':11A,71B 'runscript':176C 'self':28B 'self-host':27B 'server':76B 'sql':5A,62B,167C 'stirl':2A,31B,34B,136C 'stirling':21A 'stirling-pdf':1A,20A,30B,33B,135C 'upload':9A,59B,164C 'use':156C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-113605","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113605","severity":null,"published_at":"2026-10-20T16:17:10+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113605:614","url":null,"severity":null,"published_at":"2026-10-24T00:13:56+00:00","modified_at":"2026-10-24T00:13:56+00:00","first_seen_at":"2026-10-24T00:13:56+00:00","fetched_at":"2026-10-24T00:13:56+00:00","note":"Read VulnCheck CNA advisory, Abraxas Labs writeup and public PoC. Admin-only (ROLE_ADMIN), not reachable unauthenticated (lab: 401). No vendor advisory or fixed version found: 3.2.1 (21 Oct) release notes do not mention it; GHSA-j8f5-2f4f-jm2m page not retrievable. No X conversation (count 0)."}],"documents":[{"id":2488,"url":"https://www.vulncheck.com/advisories/stirling-pdf-2.13.2-through-3.2.0-h2-sql-denylist-bypass-via-import-database","title":"VulnCheck: Stirling-PDF H2 SQL denylist bypass via import-database","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2489,"url":"https://abraxaslabs.tech/research/stirling-h2-import-leftover","title":"Abraxas Labs: Stirling-PDF 3.2.0 H2 CREATE OR REPLACE ALIAS leftover","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":2490,"url":"https://github.com/abraxas/stirling-h2-import-leftover","title":"PoC: stirling-h2-import-leftover (loopback lab)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":2491,"url":"https://github.com/Stirling-Tools/Stirling-PDF/releases","title":"Stirling-PDF releases (3.2.1 notes do not mention this fix)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}