---
id: "CVE-2026-113605"
kind: "vulnerability"
aliases: ["CVE-2026-113605"]
title: "Stirling-PDF: admin SQL import bypass lets uploaded backup run Java code"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Stirling-PDF", "fixed": [], "affected": ">= 2.13.2, <= 3.2.0", "ecosystem": "github"}]
ecosystems: []
tags: ["docker", "h2", "java", "package", "self-hosted", "stirling-pdf"]
not_affected_if: ["auth-required", "default-config", "lite-build", "no-admin-access", "postgresql-datasource"]
published_at: "2026-10-20T16:17:10+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-24T00:13:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113605", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:13:56+00:00"}]
---

# Stirling-PDF: admin SQL import bypass lets uploaded backup run Java code

Stirling-PDF 2.13.2 to 3.2.0: the import-database denylist in DatabaseService.validateSqlContent() blocks CREATE ALIAS but not CREATE OR REPLACE ALIAS. A ROLE_ADMIN who uploads a crafted SQL backup can define H2 Java function aliases and run Java methods on the server. Public PoC (lab proved the alias import; host file read and RCE are inferred from the earlier CVE-2026-85714, not lab-proven). Needs admin credentials; the default first admin is admin/stirling until changed. Only the fat/with-login build with the default embedded H2 is affected: the lite build lacks the controller and a custom PostgreSQL datasource disables it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:Stirling-PDF affected >= 2.13.2, <= 3.2.0 fixed ?

## How to check

Run a version 2.13.2 to 3.2.0 and you are in range. Check with the Docker image tag (e.g. stirlingtools/stirling-pdf:3.2.0-fat) or the version shown in the app. Exposed only if login is enabled, the default embedded H2 database is used, and the fat/proprietary build is running. Check that the admin password is not the default admin/stirling, and who holds ROLE_ADMIN.

## Fix

No confirmed fixed version: the 3.2.1 release notes do not mention it, so verify against the vendor advisory GHSA-j8f5-2f4f-jm2m before relying on it. Until then: restrict admin accounts, change the default admin password, keep the admin UI off the public internet. Upstream fix suggested by the researcher: change the denylist regex to (?i)\bCREATE\s+(OR\s+REPLACE\s+)?(FORCE\s+)?ALIAS\b and validate the same bytes RUNSCRIPT executes.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113605
- 2026-10-24T00:13:56+00:00 analyst — Read VulnCheck CNA advisory, Abraxas Labs writeup and public PoC. Admin-only (ROLE_ADMIN), not reachable unauthenticated (lab: 401). No vendor advisory or fixed version found: 3.2.1 (21 Oct) release notes do not mention it; GHSA-j8f5-2f4f-jm2m page not retrievable. No X conversation (count 0).

## Documents

- [advisory] VulnCheck: Stirling-PDF H2 SQL denylist bypass via import-database https://www.vulncheck.com/advisories/stirling-pdf-2.13.2-through-3.2.0-h2-sql-denylist-bypass-via-import-database
- [describes] Abraxas Labs: Stirling-PDF 3.2.0 H2 CREATE OR REPLACE ALIAS leftover https://abraxaslabs.tech/research/stirling-h2-import-leftover
- [mentions] Stirling-PDF releases (3.2.1 notes do not mention this fix) https://github.com/Stirling-Tools/Stirling-PDF/releases
- [poc] PoC: stirling-h2-import-leftover (loopback lab) https://github.com/abraxas/stirling-h2-import-leftover

## From the sources

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_