CVE-2026-85714 Stirling-Tools CVE debrief

Who should care

Administrators and users of Stirling-PDF versions prior to 2.13.2 should assess exposure and prioritize remediation. This includes reviewing system configurations, verifying affected versions, and applying patches or mitigations as needed. Security teams should also monitor for potential exploitation attempts and review logs for suspicious activity.

Why it matters

CVE-2026-85714 is a critical remote code execution vulnerability in Stirling-PDF that allows an authenticated administrator to execute arbitrary file access and operating-system command execution as the JVM service account. Defenders should prioritize remediation and verify affected versions.

• Arbitrary file access and operating-system command execution as the JVM service account
• Potential for lateral movement and privilege escalation
• Need for verification of affected versions and remediation status

Technical summary

The vulnerability exists in Stirling-PDF versions prior to 2.13.2. An authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access and can lead to operating-system command execution as the JVM service account. The issue is fixed in version 2.13.2.

Defensive priority

High

Recommended defensive actions

• Upgrade to version 2.13.2 or later
• Restrict access to the /api/v1/database/import-database endpoint
• Monitor for suspicious activity on the Stirling-PDF application
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists in Stirling-PDF versions prior to 2.13.2. An authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database, allowing dangerous H2 functions to bypass the whitelist and execute side effects. Evidence is based on the CVE record and vendor advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.