# CVE-2026-85714: Stirling-PDF - RCE

> Live exploitation tracking for CVE-2026-85714 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-85714

## Key facts

- **Exploitation phase:** Insufficient Data. Not enough CrowdSec telemetry data is available to confidently assess how this vulnerability is exploited in the wild.
- **CVSS score:** 9.1
- **Public exploit available:** Yes
- **Affected products:** Stirling-Tools Stirling-PDF
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** web_application

## Description

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.

## CrowdSec analysis

[CVE-2026-85714](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-85714) is a critical SQL import validation bypass in Stirling-PDF versions prior to 2.13.2, affecting deployments using the default H2 database and security mode. An authenticated administrator can upload a crafted SQL file to access arbitrary files and potentially execute operating-system commands as the JVM service account. Upgrade to version 2.13.2 or later to address the vulnerability.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-85714 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed exploitation attempts authenticate via `/api/v1/auth/login` and upload a crafted SQL backup to `/api/v1/database/import-database`. The SQL uses H2 `FILE_READ` with an external callback URL to trigger command execution and verify the vulnerability.

## Timeline

- 2026-10-14: CVE Published. CVE-2026-85714 is published to NVD.
- 2026-10-23: Rule Released. CrowdSec releases a rule to detect CVE-2026-85714 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-mrr8-934j-4g8m
- https://github.com/Stirling-Tools/Stirling-PDF/pull/6796
- https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2
- https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-85714.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-85714) follows observed exploitation activity for CVE-2026-85714. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.