Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Stirling-PDF lets admin run code on server

CVE-2026-85714 · published 1 day ago
Summary

If an administrator uses the default database in Stirling-PDF versions before 2.13.2, they can upload a specially crafted file that causes the system to read or write arbitrary files and execute commands. This can let an attacker run code on the server under the service account. Upgrade to version 2.13.2 or later to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
stirling-tools stirling-pdf < 2.13.2
Original advisory text
Stirling-PDF: Remote Code Execution via H2
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published14 Oct 2026
Updated16 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-85714 · NVD
CVE-2026-85714 · MITRE
Track software like this
Free during beta