CVE-2026-109347 in Adminer
Summary
by MITRE • 10/12/2026
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Adminer versions prior to 6.1.1 represents a critical remote code execution flaw that exploits weaknesses in how the application handles SQLite database operations, specifically regarding file attachment and vacuuming processes. This issue primarily affects authenticated users who possess access to execute SQL statements against an underlying SQLite database instance. The core technical failure lies in the insufficient sanitization of input data when processing specific SQL commands such as ATTACH and VACUUM INTO. By leveraging a UTF-8 byte-order mark, which is typically used to indicate the encoding format of text files but can be manipulated here, attackers are able to bypass security restrictions designed to limit where database files can be attached or written. This manipulation allows the attacker to specify arbitrary file paths that fall outside the intended secure directories, effectively granting them write access to locations on the server's filesystem that were previously protected by administrative controls.
The operational impact of this vulnerability is severe, as it directly leads to remote code execution under the context of the web server process. Once an attacker successfully attaches a database file at a PHP-served path or creates a table with a name containing executable PHP code, they can trigger the execution of that code when the system attempts to interact with the newly created structure. Because SQLite allows for dynamic schema creation and manipulation, the attacker can craft a table name that includes valid PHP syntax. When this malformed request is processed by Adminer, the web server interprets the file as executable script rather than static data or database metadata. This results in the arbitrary execution of system commands with the privileges assigned to the web server user, which often include read and write access to sensitive application files, configuration settings, and potentially other parts of the hosting environment.
From a classification perspective, this vulnerability aligns closely with CWE-94 Improper Control of Generation of Code or Script, commonly known as code injection, specifically within the context of dynamic SQL execution and file path manipulation. It also relates to CWE-22 Path Traversal, as the attacker bypasses restrictions on where files can be attached by manipulating input to traverse directory boundaries or target specific executable directories. In terms of adversary tactics, this exploit maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, particularly sub-techniques involving PHP execution, allowing for lateral movement and further compromise of the host system. The use of a byte-order mark serves as an obfuscation method that evades basic input validation checks, highlighting the importance of robust parsing logic in database management interfaces.
Mitigation strategies must focus on immediate patching and enhanced input validation. Administrators should upgrade Adminer to version 6.1.1 or later, where these specific bypass mechanisms have been addressed by developers through stricter sanitization of SQL commands and file path restrictions. In environments where upgrading is not immediately feasible, implementing strict web application firewall rules can help detect and block requests containing suspicious byte-order marks in SQL parameters or attempts to attach files to PHP directories. Additionally, ensuring that the database management tool operates with minimal privileges on the underlying operating system will limit the potential damage if an exploit succeeds. Regular audits of file permissions and monitoring for unusual file creation events in web-accessible directories can also aid in early detection of such exploitation attempts.