Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-113605Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database

High 7.2

In plain English

A high-severity security flaw in Stirling-PDF from Stirling-Tools. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.7%top 48.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.

Affected products (as reported)

Vendor	Product	Versions
Stirling-Tools	Stirling-PDF	2.13.2 – through 3.2.0

Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/abraxas/stirling-h2-import-leftover exploit, technical-description
https://abraxaslabs.tech/research/stirling-h2-import-leftover technical-description
https://abraxaslabs.tech/research/stirling-pdf-3.2.0-leftovers technical-description
https://github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/security/service/DatabaseService.java technical-description
VulnCheck Advisory: Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database third-party-advisory