CVE-2026-56703: Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO

Q: Who can exploit this issue?

An authenticated attacker who can submit SQLite queries through Adminer can exploit it. The attack does not require user interaction and is reachable over the network.

Q: What capability does exploitation require?

The attacker needs sufficient Adminer access to execute SQLite SQL statements. They can use VACUUM INTO to write PHP code to an arbitrary file path, then execute commands on the server.

Q: Are ATTACH restrictions sufficient mitigation?

No. The vulnerability exists because VACUUM INTO remains available even where ATTACH is restricted, allowing file writes through SQLite query handling.

Q: Which versions need remediation?

Adminer versions before 5.4.3 are affected. Upgrade to 5.4.3 or later.

Published Aug 25, 2026

Updated

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.

Affected Software

1 affected component

Adminer Adminer<5.4.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Adminer to a version that resolves this vulnerability.
Fixed in 5.4.3

Event History

Aug 25, 2026

CVE Published

via MITRE·01:30 AM

Data Sourced

via MITRE·01:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated attacker who can submit SQLite queries through Adminer can exploit it. The attack does not require user interaction and is reachable over the network.

What capability does exploitation require?

The attacker needs sufficient Adminer access to execute SQLite SQL statements. They can use VACUUM INTO to write PHP code to an arbitrary file path, then execute commands on the server.

Are ATTACH restrictions sufficient mitigation?

No. The vulnerability exists because VACUUM INTO remains available even where ATTACH is restricted, allowing file writes through SQLite query handling.

Which versions need remediation?

Adminer versions before 5.4.3 are affected. Upgrade to 5.4.3 or later.

CVE-2026-56703: Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What capability does exploitation require?

Are ATTACH restrictions sufficient mitigation?

Which versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What capability does exploitation require?

Are ATTACH restrictions sufficient mitigation?

Which versions need remediation?