Stirling-PDF Users Urged to Patch Critical Admin RCE Flaw in Version 2.13.2

Stirling-Tools has released version 2.13.2 of Stirling-PDF to address a critical security flaw identified as CVE-2026-85714. This vulnerability affects all versions of the locally hosted PDF management application prior to the current release. The issue carries a CVSS score of 9.1, rating it as critical severity. It enables authenticated administrators to execute arbitrary operating-system commands on the server hosting the application.

How it unfolded

• The vulnerability exists in the database import functionality available to authenticated administrators.
• Attackers can upload a crafted SQL file to the /api/v1/database/import-database endpoint.
• The application processes this file using the H2 database engine by default.

Who is affected

Organizations using Stirling-PDF versions earlier than 2.13.2 are at risk. The flaw specifically impacts systems configured with the default H2 database and standard security modes. The application’s validation logic, found in DatabaseService.validateSqlContent(), fails to properly sanitize input. It splits normalized input on semicolons and accepts statements containing allowed keywords. This insufficient whitelist allows dangerous H2 functions like FILE_READ and CSVWRITE to bypass checks. Additionally, the CREATE ALIAS command can be used to trigger side effects.

Our take on the response

The vendor has provided a direct fix in version 2.13.2. The vulnerability stems from inadequate input validation during SQL file imports. By allowing specific H2 functions to execute, the application permits arbitrary file access. The demonstrated attack chain involves writing attacker-controlled startup files to a user-site location. This triggers an application Python interpreter configured to load those files. The result is command execution running as the JVM service account. This confirms the severity rating assigned by the National Vulnerability Database.

Who needs to act first

Managed service providers should prioritize updating any exposed Stirling-PDF instances immediately. Teams usually begin by identifying all customer environments running versions prior to 2.13.2. It is advisable to back up current configurations before applying the update. Verify that the new version is functioning correctly in a test environment first. If immediate patching is not possible, restrict access to the administration interface. Monitor logs for unusual database import activities or unexpected file creation events. Reduce exposure by ensuring only trusted administrators have login credentials.

What to do and how to stay safe: Stirling-PDF

• Verify the current version of Stirling-PDF on all managed servers and compare it against the safe version 2.13.2.
• Apply the vendor-provided update to remediate the SQL injection vulnerability and close the remote code execution path.
• Review access logs for the database import endpoint to detect any prior unauthorized attempts or successful exploits.
• Ensure that administrative accounts use strong authentication methods to limit the ability of attackers to trigger the flaw.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-85714?

The National Vulnerability Database rates the vulnerability as 9.1, which is considered critical severity.

Which versions of Stirling-PDF are vulnerable?

All versions of Stirling-PDF prior to 2.13.2 are affected by this security flaw.

Does the fix require a new installation?

The source material indicates the issue is fixed in version 2.13.2, implying an update resolves the problem.