CVE-2026-34967: Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write
Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adminer (sql-log plugin)to a version that resolves this vulnerability.Fixed in 5.3.0 through 5.4.2 - Upgrade
Upgrade
Adminer (sql-log plugin)to a version that resolves this vulnerability.Fixed in 5.4.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Only Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled are described as affected. Deployments without that plugin enabled are not identified as affected by the provided information.
What access does an attacker need?
An attacker must be authenticated to exploit the issue. They can use path-traversal sequences in the sql-log plugin's ns parameter to select a writable directory and write an attacker-controlled .sql file.
What can be written to the host?
The vulnerability permits writing arbitrary .sql files with attacker-controlled content to any directory writable by the affected Adminer process or environment. The provided information does not establish the ability to write other file extensions.