CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...

CVE-2026-85714 Stirling-PDF: Remote Code Execution via H2

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...

CVE-2026-85714

The Stirling-PDF web application is vulnerable to Remote Code Execution (RCE) in versions prior to 2.13.2 . An authenticated administrator using the default H2 database can upload a crafted SQL file via the POST /api/v1/database/import-database endpoint. The DatabaseService.validateSqlContent() m...