CVE-2026-109347: Improper Control of Generation of Code ('Code Injection') in vrana adminer
Description
Adminer versions before 6.1.1 have a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by using a UTF-8 byte-order mark prefix. This enables attackers to attach a database file at a PHP-served path and create a table named with PHP code, which can then be executed as the web server user.
CVSS v4.0
Score 8.6high
Affected software
vrana
adminer
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109347 describes a remote code execution vulnerability in Adminer prior to version 6.1.1. Authenticated SQLite users can bypass ATTACH and VACUUM INTO restrictions by prefixing SQL statements with a UTF-8 byte-order mark. This bypass allows attackers to attach a database file located at a PHP-served path and create a table whose name contains PHP code. When accessed, this PHP code executes with the privileges of the web server user, leading to potential full system compromise.
Potential Impact
Successful exploitation allows authenticated SQLite users to execute arbitrary PHP code on the server with the privileges of the web server user. This can lead to remote code execution, potentially compromising the entire system hosting Adminer.
Mitigation Recommendations
Upgrade Adminer to version 6.1.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the affectedVersions field indicating versions before 6.1.1 are vulnerable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:19:45.859Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd0c162cdf04f656b11c07
Added to database: 10/12/2026, 16:34:30 UTC
Last enriched: 10/12/2026, 16:49:18 UTC
Last updated: 10/12/2026, 21:46:40 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.