CVE-2026-34968: Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop
Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Adminer and able to access SQLite mode. Exploitation is network-reachable and requires no user interaction.
What access is required for a successful attack?
The attacker needs a valid authenticated session and must be able to submit a database-list drop request with a crafted db[] parameter. The vulnerable deletion is limited to files writable by the PHP process.
How can I tell whether my deployment is affected?
Deployments using Adminer before 5.4.3 are affected when SQLite mode is available. Review whether authenticated users can reach the database-list drop action and whether the PHP process can write files outside intended SQLite database locations.