Authenticated SQL Injection in Stirling-PDF via H2 Alias Bypass

Executive Summary

CVE-2026-113605 is a vulnerability in Stirling-PDF versions 2.13.2 through 3.2.0 where an incomplete denylist in SQL content validation allows bypassing H2 import restrictions. Authenticated administrators can upload malicious SQL backups using CREATE OR REPLACE ALIAS to define Java function aliases, enabling arbitrary code execution via RUNSCRIPT during backup operations.

Useful 0 Not Useful 0

Detection Guidance

Check Stirling-PDF versions between 2.13.2 and 3.2.0. Inspect logs for suspicious import-database endpoint activity or attempts to use CREATE OR REPLACE ALIAS commands. Verify if admin accounts accessed the /api/v1/database/import-database endpoint with unusual payloads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows authenticated administrators to execute arbitrary Java code remotely, potentially leading to full system compromise. Attackers could read sensitive files, modify data, or escalate privileges by exploiting the H2 database import functionality. The impact depends on the system's configuration and privileges of the compromised account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's confidentiality requirements and HIPAA's security rules for protected health information. Organizations using affected Stirling-PDF versions may face compliance violations, data breaches, and potential regulatory penalties if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Stirling-PDF to a patched version beyond 3.2.0. Disable the import-database endpoint if not required. Restrict ROLE_ADMIN privileges to trusted users only. Monitor for unauthorized SQL command execution attempts in logs.

Useful 0 Not Useful 0