CVE-2026-34967 describes an arbitrary file write vulnerability in Adminer versions 5.3.0 through 5.4.2 when the sql-log plugin is enabled. The vulnerability arises from insufficient validation of the ns parameter in plugins/sql-log.php, allowing an authenticated user to supply path traversal sequences. This enables writing arbitrary .sql files with attacker-controlled content to any writable directory on the host system.

An authenticated user with low privileges can write arbitrary files to the server filesystem in any writable directory. This could lead to unauthorized file creation or modification, potentially facilitating further attacks or persistence. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited privileges required.

No official patch or remediation level is currently provided. Users should monitor the vendor advisory for updates. Until a fix is available, consider disabling the sql-log plugin or restricting access to trusted authenticated users only to reduce risk.