CVE-2026-113605 [HIGH] – Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, where RUNSCRIPT defines H2 Java function aliases and restores Java-method execution.