SQL Injection Vulnerability in Stirling-PDF Web Application by Stirling Tools

CVE-2026-85714

What is CVE-2026-85714?

The Stirling-PDF web application, prior to version 2.13.2, contains a SQL injection vulnerability that allows authenticated administrators using the default H2 database configuration to upload a crafted SQL file via POST /api/v1/database/import-database. The flawed validation mechanism permits certain SQL statements to be executed, bypassing the security measures in place. This vulnerability can result in arbitrary file access and command execution through malicious startup files, posing a significant risk to the application and its underlying system. Users are advised to upgrade to version 2.13.2 or later to mitigate this security issue.

References