CVE-2026-56705: External Control of File Name or Path in vrana adminer
Adminer versions before 5.4.3 contain a vulnerability where the server field is not properly sanitized before constructing a PDO DSN string. This allows unauthenticated attackers to inject ODBC parameters via semicolons, including TraceFile and TraceOn, which can write PHP code to the web root. Accessing the trace file leads to remote code execution.
AI Analysis
Technical Summary
CVE-2026-56705 affects Adminer before version 5.4.3. The vulnerability arises because the server field is not sanitized before being used to build a PDO DSN string. Attackers can exploit this by injecting ODBC parameters such as TraceFile and TraceOn through semicolons in the server field. This injection enables writing arbitrary PHP code to the web root directory. When the trace file is accessed, the injected PHP code executes, resulting in remote code execution without requiring authentication.
Potential Impact
Successful exploitation allows unauthenticated attackers to achieve remote code execution on the server hosting Adminer by injecting PHP code into the web root via ODBC trace parameters. This can lead to full system compromise depending on the server configuration.
Mitigation Recommendations
A fix is available in Adminer version 5.4.3 and later. Users should upgrade to version 5.4.3 or newer to remediate this vulnerability. Until patched, restrict access to Adminer interfaces and monitor for suspicious activity related to ODBC parameter injection.
CVE-2026-56705: External Control of File Name or Path in vrana adminer
Description
Adminer versions before 5.4.3 contain a vulnerability where the server field is not properly sanitized before constructing a PDO DSN string. This allows unauthenticated attackers to inject ODBC parameters via semicolons, including TraceFile and TraceOn, which can write PHP code to the web root. Accessing the trace file leads to remote code execution.
CVSS v4.0
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-56705 affects Adminer before version 5.4.3. The vulnerability arises because the server field is not sanitized before being used to build a PDO DSN string. Attackers can exploit this by injecting ODBC parameters such as TraceFile and TraceOn through semicolons in the server field. This injection enables writing arbitrary PHP code to the web root directory. When the trace file is accessed, the injected PHP code executes, resulting in remote code execution without requiring authentication.
Potential Impact
Successful exploitation allows unauthenticated attackers to achieve remote code execution on the server hosting Adminer by injecting PHP code into the web root via ODBC trace parameters. This can lead to full system compromise depending on the server configuration.
Mitigation Recommendations
A fix is available in Adminer version 5.4.3 and later. Users should upgrade to version 5.4.3 or newer to remediate this vulnerability. Until patched, restrict access to Adminer interfaces and monitor for suspicious activity related to ODBC parameter injection.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-22T18:48:27.059Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a8cf57aacd9273b4984286b
Added to database: 08/25/2026, 01:52:58 UTC
Last enriched: 08/25/2026, 02:09:41 UTC
Last updated: 08/25/2026, 02:54:12 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.