CVE-2026-96634 is a remote code execution vulnerability in AdminNeo's SQLite functionality. It arises from a patch bypass exploiting catastrophic backtracking in a regular expression designed to filter ATTACH SQL statements. The vulnerability allows an attacker to bypass the ATTACH filter by causing PHP's preg_match() to fail due to excessive backtracking, enabling execution of malicious ATTACH queries that create PHP files on the server. This flaw affects AdminNeo versions prior to 5.5.1 and has a medium severity rating with a CVSS score of 6.9. A fix is available in version 5.5.1.