Adminer versions before 6.1.1 have a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by using a UTF-8 byte-order mark prefix. This enables attackers to attach a database file at a PHP-served path and create a table named with PHP code, which can then be executed as the web server user.
Adminer versions from 5.5.1 through 6.0.1 contain a server-side request forgery (SSRF) vulnerability due to improper parsing of the login 'server' string. This allows a remote unauthenticated attacker to craft a server value that bypasses privileged-port restrictions and causes the server to initiate TCP connections to arbitrary internal hosts and ports before authentication. This vulnerability enables blind internal port scanning and was fixed in version 6.0.2.
Adminer versions 6.0.0 and 6.0.1 are vulnerable to a pre-authentication Server-Side Request Forgery (SSRF) when the official ClickHouse driver plugin is loaded. An unauthenticated attacker can cause the server to send arbitrary HTTP POST requests to internal or external URLs, potentially disclosing sensitive internal information via error responses. This vulnerability is fixed in Adminer 6.0.2.
Adminer versions from 0 up to but not including 6.0.2 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch driver. This flaw allows an unauthenticated attacker to cause the server to make HTTP GET requests to arbitrary internal or external hosts by submitting crafted authentication parameters. The vulnerability enables internal network reconnaissance and service fingerprinting via error messages displayed on the login page. Exploitation requires the Elasticsearch driver to be explicitly enabled and PHP's allow_url_fopen setting to be active. The issue is fixed in Adminer version 6.0.2.
Adminer versions before 6.0.2 have a cross-site scripting (XSS) vulnerability caused by improper escaping of the CONNECTION_ID() database result in JavaScript. This flaw allows a malicious database server to execute arbitrary JavaScript in the context of the authenticated Adminer user. In deployments where the database has FILE privileges and can write to the webroot, attackers can leverage this XSS to submit authenticated SQL commands that write PHP files, potentially leading to remote code execution under the web server's account.
CVE-2026-56706 affects Adminer versions before 5.4.3 and involves a flawed CSRF token scheme that exposes the session secret through token observation. The vulnerability arises from transmitting both the XOR mask and masked value in the token, combined with low-entropy session tokens and loose comparison verification. This allows attackers to recover the session secret and forge valid CSRF tokens, enabling cross-site request forgery attacks that can execute arbitrary SQL queries in authenticated sessions.
Adminer versions before 5.4.3 contain a vulnerability where the server field is not properly sanitized before constructing a PDO DSN string. This allows unauthenticated attackers to inject ODBC parameters via semicolons, including TraceFile and TraceOn, which can be used to write PHP code to the web root and achieve remote code execution.
CVE-2026-56704 is a cross-site scripting (XSS) vulnerability in Adminer before version 5.4.3. The issue arises because unsanitized database server version strings are inserted into script tags with valid Content Security Policy (CSP) nonces without proper validation. This allows an attacker controlling a rogue MySQL server to craft malicious version strings that break out of the JavaScript context and execute arbitrary code, bypassing CSP protections.
Adminer versions prior to 5.4.3 contain a remote code execution vulnerability related to improper handling of SQLite VACUUM INTO commands. Authenticated attackers can exploit this flaw to write and execute arbitrary PHP code on the server by bypassing ATTACH restrictions. This vulnerability has a high severity rating and a CVSS score of 8.6.
Adminer versions before 5.4.3 have an unrestricted file upload vulnerability in the AdminerFileUpload plugin. Authenticated users can upload PHP files due to a permissive default extension allowlist. This allows attackers to upload PHP webshells to database columns ending with _path and execute arbitrary code as the web-server user if the upload path is web-accessible.
Adminer versions prior to 5.4.3 contain a path traversal vulnerability in SQLite mode that allows authenticated users to delete arbitrary files writable by the PHP process. This occurs because the database-list drop action does not properly validate file extensions before deletion, enabling attackers to submit crafted relative file paths via the db[] parameter.
Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.
Adminer versions prior to 5.5.0 contain a server-side request forgery (SSRF) vulnerability in the login form's server field validator. The validator incorrectly inspects only leading integers for privileged ports and fails to reject non-numeric port values. This flaw allows attackers to inject PDO DSN keys such as host= and port= into the server parameter, bypassing privileged-port restrictions and enabling TCP connections to arbitrary internal hosts and ports before authentication.
Adminer versions from 4.6.0 up to but not including 5.5.0 improperly validate the client-supplied X-Forwarded-Prefix header. This header value is prepended to the $_SERVER["REQUEST_URI"] without trusted-proxy checks or validation, allowing attackers to supply absolute URLs that affect redirect headers, cookie path attributes, and self-referential links. While this enables open redirect and session cookie path control, it does not allow header splitting or cross-site scripting due to the inability to inject CR/LF characters.
Adminer versions 4.6.0 through 5.5.0 contain an incomplete fix for a prior X-Forwarded-Prefix header validation issue. The vulnerability allows certain malformed prefixes with backslashes to bypass validation, leading to anomalous cookie-path scoping. Exploitation requires the ability to set the X-Forwarded-Prefix header, typically due to a misconfigured or absent reverse proxy. The issue was fixed in version 5.5.1. The impact is limited and considered low severity.
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.
CVE-2026-25892 is a high-severity vulnerability in Adminer versions 4.6.2 up to 5.4.1, caused by improper input validation in the version check mechanism. The vulnerability arises because the ? script=version endpoint accepts POST requests from any origin without validating the source, allowing an attacker to send a crafted version[] parameter. This parameter is converted by PHP into an array instead of a string, causing openssl_verify() to throw a TypeError and resulting in an HTTP 500 error that disrupts service for all users. No authentication or user interaction is required to exploit this remotely over the network. The impact is a denial-of-service condition affecting availability.