CrowdSecLive Exploit Tracker
Insufficient DataCVE-2026-85714Public Exploit

Stirling-PDF - RCE (CVE-2026-85714)

PublishedOct 14, 2026
First SeenN/A
Last Seen
Reported
CVSS9.1
ST
Stirling-ToolsStirling-PDF
web_application

Description

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.

psychologyCrowdSec Analysis

CVE-2026-85714 is a critical SQL import validation bypass in Stirling-PDF versions prior to 2.13.2, affecting deployments using the default H2 database and security mode. An authenticated administrator can upload a crafted SQL file to access arbitrary files and potentially execute operating-system commands as the JVM service account. Upgrade to version 2.13.2 or later to address the vulnerability.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-85714 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed exploitation attempts authenticate via /api/v1/auth/login and upload a crafted SQL backup to /api/v1/database/import-database. The SQL uses H2 FILE_READ with an external callback URL to trigger command execution and verify the vulnerability.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2026-10-14
Rule Released2026-10-23

Related Weaknesses

CWE-94: Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References