CVE-2026-56703
Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO
- State
- Published
- Severity
- 8.6 High
- Published
- Aug 25, 2026
- Updated
- Aug 25, 2026
- Reserved
- Jun 22, 2026
Description
Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
adminervrana |
|
References
- GitHub Security Advisory (GHSA-gmx3-g29w-77wf)vendor-advisory
- VulnCheck Advisory: Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTOthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.