Stirling-PDF administrators face high-risk SQL bypass vulnerability in versions through 3.2.0
Authenticated admins can bypass import restrictions in Stirling-PDF using crafted SQL backups, allowing Java execution in versions up to 3.2.0.
Key points
- Stirling-PDF versions 2.13.2 through 3.2.0 contain a high-severity vulnerability (CVSS 8.6).
- The flaw allows authenticated administrators to bypass H2 database import restrictions.
- No patch or fix has been confirmed by the vendor or in the source material.
Stirling-PDF products running versions 2.13.2 through 3.2.0 are affected by a high-severity vulnerability that permits authenticated administrators to execute Java code within the H2 database engine. The flaw resides in the `DatabaseService.validateSqlContent()` method, which maintains an incomplete denylist. According to the National Vulnerability Database record for CVE-2026-113605, this weakness allows attackers to bypass intended security restrictions when importing database backups.
How it unfolded
- Stirling-PDF versions 2.13.2 through 3.2.0 were identified as containing the incomplete denylist flaw.
- The National Vulnerability Database assigned CVE-2026-113605 to this specific vulnerability.
- The flaw was categorized under CWE-184, indicating an error in the implementation of security controls.
Who is affected
Organizations using Stirling-PDF from version 2.13.2 up to and including version 3.2.0 are directly affected. The vulnerability specifically impacts systems where authenticated administrators have access to the import-database endpoint. According to the NVD record, the issue stems from the `DatabaseService.validateSqlContent()` function. This component fails to adequately restrict certain SQL commands, creating a pathway for unintended code execution within the H2 database environment managed by the application.
Our take on the response
The National Vulnerability Database rates this vulnerability as High with a CVSS score of 8.6. This rating reflects the ease with which an authenticated administrator can leverage the flaw to alter database behavior. The core issue is an incomplete denylist, meaning the security control exists but has gaps. That suggests the vendor’s validation logic needs significant tightening to prevent the specific `CREATE OR REPLACE ALIAS` command from being processed during import operations.
Who needs to act first
Managed service providers should immediately identify all client environments running Stirling-PDF versions between 2.13.2 and 3.2.0. Prioritize systems exposed to untrusted networks or those with multiple administrative accounts. Isolate affected instances from general network traffic to limit lateral movement potential. Verify that only essential personnel possess administrator credentials for these specific applications. Monitor database logs for unusual import activities or new alias creations. Prepare a rollback plan before making any configuration changes to ensure service continuity.
What to do and how to stay safe: Stirling-PDF
- Audit all Stirling-PDF deployments to confirm they are running versions 2.13.2 through 3.2.0.
- Restrict access to the import-database endpoint to trusted internal networks only.
- Monitor administrative logs for any use of the CREATE OR REPLACE ALIAS command.
- Wait for an official vendor update before attempting unofficial patches or workarounds.
Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Stirling-PDF are affected by this vulnerability?
Stirling-PDF versions 2.13.2 through 3.2.0 are affected by CVE-2026-113605.
Is there a patch available for this vulnerability?
No fix has been confirmed yet according to the provided source material.
What is the CVSS score for this vulnerability?
The National Vulnerability Database assigns a CVSS score of 8.6, rated as High.
