CVE-2026-113605 Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database

High 8.6 Published 20 Oct 2026 Updated 20 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-113605?

CVE-2026-113605 is a high-severity vulnerability in Stirling-Tools Stirling-PDF, published on 20 Oct 2026.

Official description

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.

Weakness: CWE-184

Which versions are affected by CVE-2026-113605?

How do I fix CVE-2026-113605?

No fix has been published for CVE-2026-113605 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-113605 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-113605 exists.

Sources

Also known as GHSA-j8f5-2f4f-jm2m.