Stirling-PDF: Remote code execution via H2 database import
Summary
An authenticated administrator can upload a crafted SQL file through the database import function of Stirling-PDF when the default H2 database and security mode are used. The validation only checks for allowed keywords, so dangerous H2 functions such as FILE_READ and CSVWRITE can still run, which permits arbitrary file access. The published attack chain leads to command execution as the service account running the application. Exploitation requires administrator credentials.
Affected
- Stirling-PDF versions before 2.13.2 (the exact lower bound is unknown; sources disagree)
- Relevant configuration: default H2 database with security mode enabled
Fixed in
- Fixed in Stirling-PDF 2.13.2
Workaround
- Unknown. The vendor has not documented a workaround; upgrading to 2.13.2 is the recommended fix.
- Restrict access to the database import function and the admin panel until patched.
Exploitation
- Exploitation requires administrator-level authentication (CVSS PR:H).
- CISA SSVC: exploitation status poc (proof of concept public), not automatable.
- No confirmed exploitation in the wild; not listed in CISA KEV at the time of research.
Our recommendation
- Upgrade Stirling-PDF to version 2.13.2 or later.
- Check whether the instance uses the default H2 database and whether it is reachable from the internet; restrict or remove public access.
- Change default admin credentials and use strong, unique passwords.
- Review logs for unexpected database import requests and new startup or script files on the host.
- After upgrading, check the vendor's release notes and advisory for follow-up fixes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mrr8-934j-4g8m github.com
- Stirling-PDF Release v2.13.2 github.com
- Fix commit d06d3ca github.com
- Pull request #6796 github.com
- Stirling-PDF security page github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:35.
Original description (NVD)
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.
NVD references (5)
- https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5
- https://github.com/Stirling-Tools/Stirling-PDF/pull/6796
- https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2
- https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-mrr8-934j-4g8m
- https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-mrr8-934j-4g8m
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.