Read the docs
TI-2026-76934 Aliases CVE-2026-113605GHSA-j8f5-2f4f-jm2m

Stirling-PDF H2 SQL denylist bypass allows Java method execution

Priority HIGH 72CWE-184Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Stirling-PDF from 2.13.2 through 3.2.0 has an incomplete denylist in DatabaseService.validateSqlContent() that fails to block H2 CREATE OR REPLACE ALIAS statements. The flaw is an incomplete list of disallowed inputs (CWE-184) that lets a crafted SQL backup define H2 Java function aliases during RUNSCRIPT. An authenticated administrator can upload such a backup to the import-database endpoint to run Java methods. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00661 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Stirling-ToolsStirling-PDF2.13.2 – 3.2.0—No fix listedCNA
  • Stirling-PDF VendorStirling-Tools Affected 2.13.2 – 3.2.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Stirling-PDF.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113605
  2. 2026-10-20 CISA SSVC decision points changed
  3. 2026-10-20 Priority changed: MEDIUM → HIGH
  4. 2026-10-21 Alias added: GHSA-j8f5-2f4f-jm2m

References

Exploit 1

Other 3

  • TI-2025-34843 Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf CVSS 3.1CRITICAL 9.8
  • TI-2025-34834 Stirling-PDF SSRF vulnerability on /api/v1/convert/file/pdf CVSS 3.1CRITICAL 9.8
  • TI-2025-34833 Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf CVSS 3.1CRITICAL 9.8
  • TI-2026-74445 Code injection in Stirling-PDF via H2 database import CVSS 3.1CRITICAL 9.1
  • TI-2025-29281 Stirling-PDF Server-Side Request Forgery (SSRF)-Induced Arbitrary File Read Vulnerability CVSS 4.0HIGH 7.7
  • TI-2026-41398 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint CVSS 3.1HIGH 8.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences