CVE-2026-85714

Summary

Stirling-PDF allows authenticated administrators with default H2 database settings to upload malicious SQL files that bypass validation checks and execute dangerous H2 functions like FILE_READ and CSVWRITE, enabling arbitrary file access and command execution as the JVM service account.

Exploitability

Exploitation requires an authenticated administrator account with default H2 database configuration, making it moderately difficult but possible for attackers who can gain admin access.

Blast radius

The vulnerability could impact organizations where Stirling-PDF is deployed with default settings, potentially allowing attackers to execute arbitrary commands and access sensitive files on the server as the JVM service account.

Detection

Monitor for POST requests to /api/v1/database/import-database endpoint with suspicious SQL content in request bodies, particularly those containing FILE_READ, CSVWRITE, or CREATE ALIAS statements that bypass the validation whitelist.

Prioritized remediation

Upgrade to version 2.13.2 or later to fix the SQL injection vulnerability in database import functionality.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.