Stirling-PDF CVE-2026-113605

Requires an authenticated Stirling-PDF administrator account and access to the import-database endpoint on an affected version (2.13.2 through 3.2.0). The malicious input is a crafted SQL backup that uses CREATE OR REPLACE ALIAS plus RUNSCRIPT to define H2 Java function aliases, which the incomplete denylist in DatabaseService.validateSqlContent() fails to block, restoring Java-method execution. The principal limiting factor is the administrator privilege requirement (PR:H): the vulnerability is not reachable by anonymous or low-privileged users, so realistic risk is confined to compromised or abused admin credentials and malicious administrators on shared/multi-tenant instances. No victim user interaction is required (UI:N).

The CVSS 4.0 base score of 8.6 looks severe, but the single most important mitigating signal is PR:H - exploitation requires an already-authenticated administrator. This is therefore not a remote-unauthenticated compromise but an escalation/control-bypass: an admin (or an attacker who has stolen admin credentials) turns web-admin access into arbitrary Java code execution on the host by defeating the H2 import denylist (CWE-184, incomplete denylist). AV:N/AC:L/UI:N mean that once admin access exists the final step is easy and reliable, and a public POC plus a VulnCheck advisory confirm the technique is real and reproducible. No CISA KEV listing and no EPSS score were provided in the input, so there is no evidence of active or widespread exploitation and no modeled exploitation probability to weigh. Net assessment: a genuine high-impact issue for anyone who treats the Stirling-PDF admin boundary as a security boundary (it effectively becomes RCE-equivalent), but lower real-world urgency than an unauthenticated flaw because the admin prerequisite is a substantial gate. Missing data to note explicitly: EPSS and KEV status were not supplied, and no fixed version is stated in the input.

An attacker who has obtained Stirling-PDF administrator access (via stolen/weak credentials, a shared instance, or a malicious insider) crafts a SQL backup file that uses CREATE OR REPLACE ALIAS together with RUNSCRIPT to register an H2 Java function alias. They upload it to the import-database endpoint, and on import the alias restores Java-method execution, yielding arbitrary code execution on the host. A public proof-of-concept for this denylist bypass is available.