CVE-2026-85714
- Source
- https://cve.org/CVERecord?id=CVE-2026-85714
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85714.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-85714
- Aliases
-
- GHSA-mrr8-934j-4g8m
- Published
- 2026-10-14T18:22:21Z
- Modified
- 2026-10-15T13:03:30Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- Stirling-PDF: Remote Code Execution via H2
- Details
-
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. DatabaseService.validateSqlContent() splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file. This permits arbitrary file access. The demonstrated operating-system command execution chain writes attacker-controlled startup files to a user-site location and then triggers an application Python interpreter configured to load those startup files, resulting in command execution as the JVM service account. This issue is fixed in version 2.13.2.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85714.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85714.json
- https://github.com/Stirling-Tools/Stirling-PDF/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5
- https://github.com/Stirling-Tools/Stirling-PDF/pull/6796
- https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.13.2
- https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-mrr8-934j-4g8m
- https://nvd.nist.gov/vuln/detail/CVE-2026-85714
Affected packages
Git / github.com/stirling-tools/stirling-pdf
Affected versions
0.*
0.13.0
stirling-pdf-chart-1.*
stirling-pdf-chart-1.0.1
v0.*
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.12.0
v0.12.1
v0.12.2
v0.13.0
v0.13.1
v0.14.0
v0.14.1
v0.14.2
v0.14.3
v0.14.4
v0.14.5
v0.15.0
v0.15.1
v0.16.0
v0.16.1
v0.17.0
v0.17.1
v0.17.2
v0.18.0
v0.18.1
v0.19.0
v0.19.1
v0.20.0
v0.20.1
v0.20.2
v0.21.0
v0.22.0
v0.22.1
v0.22.2
v0.22.3
v0.22.4
v0.22.5
v0.22.6
v0.22.7
v0.22.8
v0.23.0
v0.23.1
v0.24.0
v0.24.1
v0.24.2
v0.24.3
v0.24.4
v0.24.5
v0.24.6
v0.25.0
v0.25.1
v0.25.2
v0.25.3
v0.26.0
v0.26.1
v0.27.0
v0.28.0
v0.28.1
v0.28.2
v0.28.3
v0.29.0
v0.3.0
v0.3.2
v0.3.3
v0.3.4
v0.30.0
v0.30.1
v0.31.0
v0.31.1
v0.32.0
v0.33.0
v0.33.1
v0.34.0
v0.35.0
v0.35.1
v0.36.0
v0.36.1
v0.36.2
v0.36.3
v0.36.4
v0.36.5
v0.36.6
v0.37.0
v0.37.1
v0.38.0
v0.39.0
v0.4.0
v0.4.2
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.40.0
v0.40.1
v0.40.2
v0.41.0
v0.42.0
v0.43.0
v0.43.1
v0.43.2
v0.44.0
v0.44.1
v0.44.2
v0.44.3
v0.45.0
v0.45.1
v0.45.2
v0.45.3
v0.45.4
v0.45.5
v0.45.6
v0.46.0
v0.46.1
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.9.0
v0.9.1
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.10.0
v2.10.1
v2.11.0
v2.12.0
v2.13.0
v2.13.1
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v2.7.3
v2.8.0
v2.9.0
v2.9.1
v2.9.2
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85714.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "309162000603170340746890382291978914232",
"length": 924
},
"id": "CVE-2026-85714-0c090c27",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/proprietary/src/main/java/stirling/software/proprietary/security/service/DatabaseService.java",
"function": "validateSqlContent"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "92143123202947394883146864914779214957",
"length": 376
},
"id": "CVE-2026-85714-219c148b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/common/src/main/java/stirling/software/common/util/SvgSanitizer.java",
"function": "isExternalUrl"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "207367343661809505023125410188296492850",
"length": 987
},
"id": "CVE-2026-85714-612d0397",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java",
"function": "addSvgAsPage"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "124422116649744783345457499634537948587",
"length": 140
},
"id": "CVE-2026-85714-61b97300",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/core/src/main/java/stirling/software/SPDF/utils/SvgOverlayUtil.java",
"function": "checkLoadExternalResource"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"30242061117942341298519385665094025774",
"174294285869338888228066796852044073570",
"318495374915696516764668937782013244753",
"94411665259848590847469864769000413069",
"107223597976591505942335355998334547232",
"70065243327012360261982705625644119356",
"105981659012000046556700625116200200765",
"7722118260528729206435591168275142185",
"53053023600263557878268281286993898505"
],
"threshold": 0.9
},
"id": "CVE-2026-85714-757fea61",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/proprietary/src/main/java/stirling/software/proprietary/security/service/DatabaseService.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "97724088240929415824351877662323870189",
"length": 1263
},
"id": "CVE-2026-85714-94dd1bfe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java",
"function": "convert"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "190517548589230623832984534515649398441",
"length": 1574
},
"id": "CVE-2026-85714-9d806978",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/core/src/main/java/stirling/software/SPDF/utils/SvgOverlayUtil.java",
"function": "overlaySvgOnPage"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"300627243227328931424008820115055632994",
"300436237725249841078450216921717847309",
"165652740520048473030222507560990380612",
"201823079461072234446699983194744691338",
"140628279215195545413950186017851946207",
"71671177827773546031310361754740458512",
"110000025072491531115882539802290483222",
"19091382788684860181542733879767989868",
"156375103635146239989300574464476704450",
"209465651921955703630984466793432865333",
"123179586900214325684113046644722779613",
"140628279215195545413950186017851946207",
"71671177827773546031310361754740458512",
"110000025072491531115882539802290483222",
"19091382788684860181542733879767989868"
],
"threshold": 0.9
},
"id": "CVE-2026-85714-b72d4b8f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"83838203533600907495087549606532571683",
"282031169847129214431324017072672307376",
"127587764915748622413580116486309937696",
"220622316609268262042734370760954644633",
"188697488330779215623662116887221593965",
"236619522259551046268161306910586693152",
"181495017332133750254837449482978219060",
"110162060228542682380156444412018828771",
"238237027036366976482284221140291620098"
],
"threshold": 0.9
},
"id": "CVE-2026-85714-bee38861",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/core/src/test/java/stirling/software/SPDF/utils/SvgToPdfTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"187706187691064683720993675221150927207",
"264754070195891291687172528668119131331"
],
"threshold": 0.9
},
"id": "CVE-2026-85714-d45e7dee",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/proprietary/src/test/java/stirling/software/proprietary/security/service/DatabaseServiceMoreTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"38203475750940553312558354710544920666",
"93602416673313859951836719138441323387",
"150378574372605191297531544083708096707",
"108519963291568029694666966260321268755"
],
"threshold": 0.9
},
"id": "CVE-2026-85714-d7d1ba75",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/core/src/main/java/stirling/software/SPDF/utils/SvgOverlayUtil.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"80630543279289569363716506825886819190",
"213572352079119322734494455193741187278",
"141762665186884031084814281442092878540",
"286998919495413387494333043062051967436",
"10360558776263140473903623215286663982",
"79766920844836587584807029189727499784",
"121874441840746836924902525901388143644"
],
"threshold": 0.9
},
"id": "CVE-2026-85714-dc0ec99a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/common/src/main/java/stirling/software/common/util/SvgSanitizer.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"128038626080175627708162630606944654632",
"59841925587601815977054085524629878135"
],
"threshold": 0.9
},
"id": "CVE-2026-85714-e3674b83",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/stirling-tools/stirling-pdf/commit/d06d3cabaf5b8a7dcd0dbfc584828d8e687e5dd5",
"target": {
"file": "app/common/src/test/java/stirling/software/common/util/SvgSanitizerTest.java"
}
}
]
vanir_signatures_modified
"2026-10-15T13:03:30Z"