CVE-2026-56703: Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO
Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adminerto a version that resolves this vulnerability.Fixed in 5.4.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated attacker who can submit SQLite queries through Adminer can exploit it. The attack does not require user interaction and is reachable over the network.
What capability does exploitation require?
The attacker needs sufficient Adminer access to execute SQLite SQL statements. They can use VACUUM INTO to write PHP code to an arbitrary file path, then execute commands on the server.
Are ATTACH restrictions sufficient mitigation?
No. The vulnerability exists because VACUUM INTO remains available even where ATTACH is restricted, allowing file writes through SQLite query handling.
Which versions need remediation?
Adminer versions before 5.4.3 are affected. Upgrade to 5.4.3 or later.