CVE-2026-113605— Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
Quick assessment
Affected
Stirling-Tools Stirling-PDF
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Stirling-PDF 2.13.2 至 3.2.0 版本中， 方法的拒绝列表（denylist）不完整，导致管理员可利用 语句绕过 H2 数据库的导入限制。已认证的管理员可上传经过篡改的 SQL 备份文件至 接口；该备份中通过 定义 H2 Java 函数别名，从而恢复 Java 方法的执行能力。
Possible ATT&CK Techniques 3 AI
T1059.007 · JavaScript T1078 · Valid Accounts T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-113605
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
Source: CVE Program / CVE List V5
Vulnerability Description
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不完整的黑名单
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Stirling-Tools | Stirling-PDF | 2.13.2 ~ 3.2.0 | - |
|
II. Public POCs for CVE-2026-113605
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-113605
请登录查看更多情报信息。
Other References for CVE-2026-113605 (5)
-
https://abraxaslabs.tech/research/stirling-pdf-3.2.0-leftovers technical-description
-
-
https://abraxaslabs.tech/research/stirling-h2-import-leftover technical-description
IV. Related Vulnerabilities
Same product: Stirling-PDF
-
CVE-2026-113606
Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Pr -
CVE-2026-85714
Stirling-PDF: Remote Code Execution via H2 -
CVE-2026-57485
Stirling-PDF: Internal Service Account API Key Disclosure vi -
CVE-2026-33437
Stirling PDF: Stored XSS in Info Summary -
CVE-2026-71270
Stirling-PDF Server-Side Request Forgery via /api/v1/convert
Same vendor: Stirling-Tools
-
CVE-2026-113606
Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Pr -
CVE-2026-85714
Stirling-PDF: Remote Code Execution via H2 -
CVE-2026-57485
Stirling-PDF: Internal Service Account API Key Disclosure vi -
CVE-2026-33437
Stirling PDF: Stored XSS in Info Summary -
CVE-2026-71270
Stirling-PDF Server-Side Request Forgery via /api/v1/convert
Same weakness: CWE-184
-
CVE-2026-112777
Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist B -
CVE-2026-104024
Incomplete dangerous-extension list in PeaZip object open al -
CVE-2026-102087
Junos OS and Junos OS Evolved: If in a traffic engineering s -
CVE-2026-108471
Windows Virtualization-Based Security (VBS) Enclave Elevatio -
CVE-2026-110205
Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token D
V. Comments for CVE-2026-113605
No comments yet