CVE-2026-85714

Awaiting Analysis Awaiting Analysis - Queue

SQL Injection in Stirling-PDF via H2 Database Import

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-85714

EUVD

EUVD-2026-101594

Affected Vendors & Products

Vendor	Product	Version / Range
Stirling-Tools	Stirling-PDF	< 2.13.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This is a critical Remote Code Execution (RCE) vulnerability in Stirling-PDF versions up to 2.11.0. An authenticated administrator can upload a crafted SQL file to execute arbitrary OS commands on the server. The flaw exists in the validateSqlContent() function, which uses an insufficient whitelist of SQL keywords to validate uploaded .sql files. Attackers bypass this whitelist using H2 database functions like FILE_READ, CSVWRITE, and CREATE ALIAS to write malicious files and trigger command execution.

Detection Guidance

Check if your Stirling-PDF instance is running a vulnerable version (prior to 2.13.2). Inspect network logs for POST requests to /api/v1/database/import-database with SQL file uploads. Look for unusual file writes or Python subprocess executions in system logs.

Impact Analysis

An attacker with admin access can execute arbitrary OS commands on the server hosting Stirling-PDF. This could lead to full system compromise, data theft, unauthorized file access, or disruption of services. The attack chain involves uploading a malicious SQL file that writes files to disk and triggers Python subprocess execution via Stirling-PDF's document conversion process.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized data access and potential data exfiltration. GDPR mandates protection against unauthorized data processing, while HIPAA requires safeguards for protected health information. The flaw enables attackers to read sensitive files and execute commands, posing significant risks to data confidentiality and integrity.

Mitigation Strategies

Upgrade Stirling-PDF to version 2.13.2 or later immediately.
Disable the /api/v1/database/import-database endpoint if not required.
Review and restrict admin access to the application.
Monitor for unauthorized file writes or suspicious SQL uploads.

Hi! I’m here to help you understand CVE-2026-85714. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70