Multiple vulnerabilities affecting Adminer

Adminer is a web database management tool, allowing administrators to easily manage MySQL, PostgreSQL, SQLite, MS SQL, Oracle, and MongoDB databases. This product is affected by several vulnerabilities labeled as follows: CVE-2026-56705: This vulnerability results from a lack of disinfection of the server field before constructing a PDO DSN chain. Exploitation of this vulnerability would allow an unauthenticated attacker to inject ODBC parameters to write PHP code in the web root directory and achieve arbitrary remote code execution. This vulnerability is classified critical with a severity score of 9.8 according to CVSS v3.1. CVE-2026-56702: This vulnerability is caused by an unrestricted file upload functionality in the AdminerFileUpload plugin, exploiting a permissive extension whitelist by default. Exploitation of this vulnerability would allow an authenticated attacker to download PHP files (webshells) and execute arbitrary code as a user of the web server. This vulnerability is classified as high with a severity score of 8.8 according to CVSS v3.1. CVE-2026-34968: This vulnerability results from arbitrary file deletion in SQLite mode, where the action of deleting the database list does not validate file extensions. Exploitation of this vulnerability would allow an authenticated attacker to submit arbitrary relative file paths to delete any file that is writable by the PHP process. This vulnerability is classified as high with a severity score of 8.1 according to CVSS v3.1. CVE-2026-56703: This vulnerability arises from remote code execution in SQLite query handling, where VACUUM INTO is not blocked despite ATTACH restrictions. Exploitation of this vulnerability would allow an authenticated attacker to execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server. This vulnerability is classified as high with a severity score of 7.2 according to CVSS v3.1. CVE-2026-56706: This vulnerability is due to a CSRF token scheme that transmits both the XOR mask and the masked value, allowing anyone observing a single token to retrieve the session secret and forge unlimited valid tokens. Exploitation of this vulnerability would allow cross-site request forgery to be performed against authenticated sessions, including the execution of arbitrary SQL queries. This vulnerability is classified as medium with a severity score of 6.8 according to CVSS v3.1. CVE-2026-56704: This vulnerability is caused by inserting unsanitized database server version strings into script tags with valid CSP nonces. Exploitation of this vulnerability would allow a malicious actor controlling a malicious MySQL server to break the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections. This vulnerability is classified as medium with a severity score of 6.1 according to CVSS v3.1. CVE-2026-34964: This vulnerability arises from server-side request forgery (SSRF) in the server field validator of the login form, which only inspects leading integers for privileged ports and does not reject non-numeric port values. Exploitation of this vulnerability would allow an attacker to inject PDO DSN keys to bypass privileged port restriction and establish TCP connections to arbitrary hosts and internal ports before authentication. This vulnerability is classified as medium with a severity score of 5.8 according to CVSS v3.1. CVE-2026-34967: This vulnerability is an arbitrary file write in the ns parameter of plugins/sql-log.php when the sql-log plugin is activated. Exploitation of this vulnerability would allow an authenticated attacker to provide path traversal sequences to write arbitrary .sql files with content controlled by the attacker to any writable directory on the host. This vulnerability is classified as medium with a severity score of 5.4 according to CVSS v3.1. CVE-2026-34959: This vulnerability is caused because Adminer prefixes the client-provided X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] without trusted proxy checking or validation of the prefix value. Exploitation of this vulnerability would allow authenticated open redirection after state-altering POST requests, unauthenticated control of the session cookie path attribute, and self-referential link poisoning. This vulnerability is classified medium with a severity score of 4.7 according to CVSS v3.1. CVE-2026-16434: This vulnerability is an incomplete fix of an earlier X-Forwarded-Prefix vulnerability. Validation rejects //evil.com but allows values ​​like /\evil.com whose second character is a backslash, which browsers normalize to a slash. Exploitation of this vulnerability would allow an impact limited to an abnormal scope of the cookie path. This vulnerability is classified as medium with a severity score of 5.4 according to CVSS V3.1.

• CVE-2026-56705, CVE-2026-56704, CVE-2026-56706, CVE-2026-56702, CVE-2026-56703, CVE-2026-34968: Adminer versions prior to 5.4.3;
• CVE-2026-34967: Adminer versions from 5.3.0 to 5.4.2 with the sql-log plugin activated;
• CVE-2026-34964, CVE-2026-34959: Adminer versions prior to 5.5.0;
• CVE-2026-16434: Adminer versions from 4.6.0 to 5.5.0;