UBUNTU-CVE-2026-119428: Medium severity ubuntu/phpmyadmin vulnerability
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
phpMyAdmin installations through 5.2.3 are exposed if an unauthenticated attacker can reach setup/validate.php over the network. The affected Ubuntu package is ubuntu/phpmyadmin.
Does disabling phpMyAdmin setup prevent exploitation?
No. The affected endpoint lacks the setup-disabled guard, so the issue can still be triggered through setup/validate.php.
What does an attacker need to exploit it?
The attacker does not need authentication or user interaction. They need network access to the vulnerable phpMyAdmin endpoint and can submit chosen host and port values to cause MySQL-protocol connection attempts.
What can an attacker do with the vulnerability?
An attacker can induce outbound connections to internal hosts and ports and use returned error messages to probe reachable internal services. The described impact is limited to information disclosure; no integrity or availability impact is specified.