CVE-2026-121263: phpMyAdmin MoTranslator Loader.php getTranslator path traversal
A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using phpMyAdmin MoTranslator versions up to and including 6.0.1 are affected, specifically where Loader::getTranslator processes the locale argument.
What does an attacker need to exploit this issue?
The attack can be performed remotely by manipulating the locale argument. The supplied severity vector indicates low privileges are required, while no user interaction is required.
Is exploit code available?
Yes. A public proof of concept has been disclosed, and the vulnerability information states that the exploit may be used.
Is a vendor fix or response identified?
No vendor response or fix is identified in the provided information. The vendor was reportedly contacted before disclosure but did not respond.