CVE-2026-56703 – Adminer
“Multiple file-handling flaws can turn database administration features into code execution and destructive file access.”
Adminer before 5.4.3 is affected by one Critical and three High-severity vulnerabilities. CVE-2026-56705 allows an unauthenticated attacker to inject ODBC parameters into the server field and write PHP code to a web-accessible path, potentially leading to remote code execution. The CVSS score is 9.8, which is Critical severity.
CVE-2026-56702 allows authenticated users to upload executable PHP files through the AdminerFileUpload plugin and has a CVSS score of 8.8, High severity. CVE-2026-34968 allows arbitrary file deletion in SQLite mode and scores 8.1, High severity. CVE-2026-56703 allows authenticated attackers to abuse SQLite VACUUM INTO to write executable PHP content and scores 7.2, High severity. Public proof-of-concept material is available for all four vulnerabilities. Adminer 5.4.3 contains the fixes.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- High
- User Interaction
- None
- CWE Classification
- CWE-94