{"id":"CVE-2026-113605","summary":"Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database","details":"Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.","modified":"2026-10-22T02:50:37.815374815Z","published":"2026-10-20T15:40:32.050Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-184"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113605.json"},"references":[{"type":"ARTICLE","url":"https://abraxaslabs.tech/research/stirling-h2-import-leftover"},{"type":"ARTICLE","url":"https://abraxaslabs.tech/research/stirling-pdf-3.2.0-leftovers"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113605.json"},{"type":"PACKAGE","url":"https://github.com/Stirling-Tools/Stirling-PDF"},{"type":"ARTICLE","url":"https://github.com/Stirling-Tools/Stirling-PDF/blob/v3.2.0/app/proprietary/src/main/java/stirling/software/proprietary/security/service/DatabaseService.java"},{"type":"EVIDENCE","url":"https://github.com/abraxas/stirling-h2-import-leftover"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113605"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/stirling-pdf-2.13.2-through-3.2.0-h2-sql-denylist-bypass-via-import-database"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/stirling-tools/stirling-pdf","events":[{"introduced":"d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5"},{"last_affected":"a7e593728dd9aa81e75318a949789d3c2e9ee754"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"2.13.2"},{"last_affected":"3.2.0"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}}],"versions":["v3.2.0","v3.1.0","v3.0.2","v3.0.1","v3.0.0","cache-v1","v2.14.0","v2.13.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113605.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}