Can Admins Run Arbitrary Commands on Stirling-PDF Before 2.13.2 via SQL Import?
A critical vulnerability in Stirling-PDF allows authenticated administrators to execute arbitrary commands via a flawed SQL import mechanism.
Key points
- CVE-2026-85714 is rated critical with a CVSS score of 9.1.
- The flaw affects Stirling-PDF versions prior to 2.13.2.
- Attackers can bypass security whitelists to read files and run commands.
Stirling-PDF, a locally hosted web application for PDF operations, contains a critical security flaw in its database import feature. According to the NVD record for CVE-2026-85714, an authenticated administrator can exploit this vulnerability to execute arbitrary commands on the host system. This issue impacts organizations relying on the tool for document management before version 2.13.2.
Root cause
The vulnerability stems from insufficient input validation in the `DatabaseService.validateSqlContent()` method. The code splits normalized SQL input on semicolons and checks for allowed keywords. This logic fails to block dangerous H2 functions like `FILE_READ` and `CSVWRITE`. Consequently, attackers can craft SQL files that bypass the whitelist and trigger side effects when processed by the `RUNSCRIPT` command.
Attack path
An attacker uploads a crafted SQL file to the `/api/v1/database/import-database` endpoint. The application processes this file using the default H2 database configuration. By leveraging functions such as `CREATE ALIAS`, the attacker gains arbitrary file access. The demonstrated exploit chain writes controlled startup files to a user-site location, then triggers a Python interpreter to load them, resulting in command execution as the JVM service account.
Affected versions
- Stirling-Tools Stirling-PDF versions prior to 2.13.2 are affected.
- The issue is fixed in version 2.13.2.
- Systems using the default H2 database and security mode are most at risk.
Mitigation
- Upgrade Stirling-PDF to version 2.13.2 or later immediately.
- Ensure administrators use strong, unique credentials for the web interface.
- Restrict access to the application to trusted networks only.
- Monitor logs for unusual SQL import activities or unexpected file creations.
What it means for organisations
Security teams must verify that all instances of Stirling-PDF are updated to the patched version. Operations managers should assess whether legacy deployments remain in production. Incident response plans should include procedures for detecting unauthorized command execution. Leadership needs to understand the risk of local privilege escalation. Suppliers providing support for this tool should confirm their clients are protected. Regular audits of administrative access rights help reduce exposure to such flaws.
What to do and how to stay safe: Stirling-PDF
- Check your inventory for any servers running Stirling-PDF versions older than 2.13.2.
- Review access logs for the database import endpoint to identify potential exploitation attempts.
- Limit administrative access to the application to a small group of trusted personnel.
- Once the vendor provides an update, apply it to all environments without delay.
Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures
General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-85714?
The National Vulnerability Database rates CVE-2026-85714 as critical with a CVSS score of 9.1.
Which versions of Stirling-PDF are vulnerable?
All versions of Stirling-PDF prior to 2.13.2 are affected by this vulnerability.
Is there a fix available for this issue?
Yes, the issue is fixed in Stirling-PDF version 2.13.2.
