CVE-2026-56702: Unrestricted Upload of File with Dangerous Type in vrana adminer
Description
Adminer versions before 5.4.3 have an unrestricted file upload vulnerability in the AdminerFileUpload plugin. Authenticated users can upload PHP files due to a permissive default extension allowlist. This allows attackers to upload PHP webshells to database columns ending with _path and execute arbitrary code as the web-server user if the upload path is web-accessible.
CVSS v4.0
Score 7.1high
Affected software
vrana
adminer
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56702 describes an unrestricted file upload vulnerability in the AdminerFileUpload plugin of Adminer prior to version 5.4.3. The vulnerability arises from a permissive default extension allowlist that permits authenticated users to upload PHP files. These files can be uploaded to columns with names ending in _path, enabling attackers to place PHP webshells. If the uploadPath is served by the web server, this leads to arbitrary code execution with the privileges of the web-server user.
Potential Impact
Successful exploitation allows authenticated users to upload and execute arbitrary PHP code on the server hosting Adminer. This can lead to full compromise of the web server process and potentially the underlying system, depending on the server configuration and privileges of the web server user.
Mitigation Recommendations
No official patch or remediation is currently confirmed. Users should check the vendor advisory for updates. Until a fix is available, restrict access to Adminer to trusted users only and avoid serving upload directories via the web server. Monitor for updates from the vendor and apply patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-22T18:48:27.059Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8cf578acd9273b49842850
Added to database: 08/25/2026, 01:52:56 UTC
Last enriched: 09/10/2026, 08:07:18 UTC
Last updated: 10/07/2026, 06:48:17 UTC
Views: 32
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.