Stirling-Tools Stirling-PDF up to 2.13.1 Database Import import-database DatabaseService.validateSqlContent unrestricted upload

Summaryinfo

A vulnerability was found in Stirling-Tools Stirling-PDF up to 2.13.1. It has been classified as problematic. Affected by this vulnerability is the function DatabaseService.validateSqlContent of the file /api/v1/database/import-database of the component Database Import. The manipulation leads to unrestricted upload. This vulnerability is traded as CVE-2026-85714. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Stirling-Tools Stirling-PDF up to 2.13.1. It has been rated as problematic. This issue affects the function DatabaseService.validateSqlContent of the file /api/v1/database/import-database of the component Database Import. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-85714 since 09/04/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

Upgrading to version 2.13.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Stirling-Tools

Name

• Stirling-PDF

Version

• 2.13.0
• 2.13.1

Website

• Product: https://github.com/Stirling-Tools/Stirling-PDF/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion