Stirling-PDF versions 2.13.2 through 3.2.0 include an incomplete denylist in DatabaseService.validateSqlContent() that allows an authenticated administrator to upload a crafted SQL backup to the import-database endpoint. The backup contains a RUNSCRIPT statement that defines H2 Java function aliases using CREATE OR REPLACE ALIAS. Because the denylist does not filter this construct, the server executes the alias, granting the attacker arbitrary Java method execution with the application's privileges.

The vulnerability affects Stirling-Tools' Stirling-PDF product, specifically all releases from 2.13.2 up to 3.2.0 inclusive. Any deployment enabling the import‑database feature for administrators is at risk.

The CVSS score of 8.6 indicates a high severity, but the EPSS score is not available, so the current exploitation likelihood remains uncertain. The vulnerability is not listed in CISA KEV. Attack requires authenticated administrative access and use of the import‑database endpoint. If those conditions are met, the attacker can execute arbitrary code and potentially compromise the entire host running the application.