CVE-2026-109347: Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adminerto a version that resolves this vulnerability.Fixed in 6.1.1
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Adminer deployments before 6.1.1 are exposed when an attacker can authenticate as a SQLite user through Adminer. The attacker must be able to submit SQLite statements through the application.
What access does an attacker need?
The attack requires high privileges and no user interaction. An authenticated SQLite user can prefix statements with a UTF-8 byte-order mark to bypass Adminer restrictions on ATTACH and VACUUM INTO.
What is the impact after successful exploitation?
An attacker can attach a database file at a PHP-served path and create a table whose name contains PHP code. When served by PHP, that code executes as the web server user, resulting in remote code execution.
What version addresses this issue?
Upgrade Adminer to version 6.1.1 or later. Versions before 6.1.1 are affected.