External risk intelligence

Stirling-PDF SQL Injection Allows Arbitrary File Read and Command Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-85714

Stirling-PDF is a locally hosted web application. While it is a network-accessible service, it is primarily intended for local or private use. While it is plausibly reachable from the internet if misconfigured or exposed intentionally by a user, it is not typically designed or expected to be a public-facing edge service or internet gateway.

Code Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Stirling-PDF, a tool for PDF manipulation. The flaw, if exploited by an authenticated administrator using specific configurations, could allow for arbitrary file access and operating system command execution. The main concern is confirming relevance and exposure due to the application's typical use case as a locally hosted service.

Allows arbitrary file access and command execution.
Critical issue with administrator privileges.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An authenticated administrator with access to Stirling-PDF could upload a specially crafted SQL file. This file, when processed by the application, could exploit insufficient validation to execute dangerous H2 database functions. This could then lead to the execution of arbitrary operating system commands by tricking the application's Python interpreter into loading attacker-controlled startup files.

Authenticated administrator access required.
Upload a crafted SQL file to import endpoint.
Arbitrary file access and command execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated administrator could execute arbitrary code on the server by uploading a crafted SQL file. This could affect the server's operating system, user data, and service behavior.

Server file system and execution.
Uploading crafted SQL files via API.
Arbitrary code execution as JVM service account.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this vulnerability in the Stirling-PDF application. The initial priority is to identify all instances of the affected technology, determine their reachability and criticality, and then pinpoint the accountable owner to plan remediation.

Identify and confirm affected asset owners.
Verify system reachability and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Stirling-PDF?

Stirling-PDF is a self-hosted web application that allows users to perform various tasks on PDF files, such as merging, splitting, converting, and compressing documents. It is typically deployed as a local service within an organization or on a private machine to manage document processing workflows without relying on external cloud-based PDF tools.

What is the vulnerability in CVE-2026-85714?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. It occurs because the application fails to properly validate SQL content uploaded to its database import function. This flaw allows an attacker to bypass security filters and execute dangerous database commands, which can be leveraged to read sensitive files or run unauthorized commands on the underlying operating system.

How does an attacker trigger this issue?

An attacker must have authenticated administrator access to the application. They trigger the flaw by uploading a specially crafted SQL file through the specific database import API endpoint. Normal, non-administrative use of the PDF manipulation features, such as uploading standard PDF documents for processing, does not trigger this vulnerability.

Is my instance of Stirling-PDF at risk?

According to Halo Surface Signal, Stirling-PDF is designed for local or private use. While it is not typically intended to be a public-facing edge service, your instance is at risk if it has been intentionally exposed to the internet or is misconfigured in a way that makes it reachable by unauthorized users who could gain administrative access.

How do I fix this security issue?

The vulnerability is resolved in Stirling-PDF version 2.13.2. To mitigate this risk, you should verify which version of the application is currently running in your environment. If you are using any version prior to 2.13.2, plan to update to the latest release as soon as possible to incorporate the security improvements that prevent the malicious processing of SQL files.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.