CVE-2026-34967 in Adminer
Summary
by MITRE • 08/25/2026
Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
Adminer versions 5.3.0 through 5.4.2 contain a critical security flaw within the sql-log plugin that allows for arbitrary file writes when the feature is enabled. This vulnerability stems from insufficient input validation regarding the ns parameter in the plugins/sql-log.php script. The application fails to properly sanitize or validate user-supplied data before using it as part of a filesystem path, creating a classic directory traversal weakness. An attacker who has obtained valid authentication credentials for the Adminer interface can exploit this flaw by injecting path traversal sequences into the ns parameter. This manipulation allows the attacker to break out of the intended directory structure and write files to arbitrary locations on the host system where the web server process has write permissions.
The technical mechanism involves the application constructing a file path using unsanitized input from the ns parameter without checking for relative path components such as dot-dot-slash sequences or absolute paths. By carefully crafting this input, an authenticated user can direct the sql-log functionality to create and populate .sql files in directories outside of its designated scope. This capability effectively bypasses standard access controls that rely on directory boundaries, granting the attacker a high degree of control over the server's file system structure. The vulnerability is particularly severe because it leverages existing authentication mechanisms, meaning any compromised or stolen user account can be used to execute this attack without requiring privilege escalation beyond the initial web application context.
The operational impact of this arbitrary file write vulnerability extends far beyond simple data corruption. Since Adminer is a database management tool, writing .sql files with attacker-controlled content allows for sophisticated post-exploitation activities. An attacker could craft malicious SQL scripts designed to exfiltrate sensitive database records, modify critical system configurations stored in the database, or create backdoors within the application logic itself. Furthermore, if the web server has permissions to execute these files through other mechanisms, such as including them via a remote file inclusion vulnerability elsewhere in the codebase, the impact could escalate to full remote code execution on the host machine. This transforms an authentication-based flaw into a potential complete system compromise.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-434: Unrestricted Upload of File with Dangerous Type, as it involves writing files that can be executed or interpreted by the application environment. In terms of threat modeling, this behavior corresponds to ATT&CK technique T1059 Command and Scripting Interpreter, specifically through file creation for subsequent execution or data staging. The exploitation also relates to lateral movement potential if these written files are used to pivot into other systems connected to the compromised database.
Mitigation strategies must focus on immediate remediation of the software version and configuration hardening. Administrators should upgrade Adminer to a patched version where this input validation issue has been resolved, ensuring that all path constructions strictly validate against directory traversal patterns. If upgrading is not immediately feasible, disabling the sql-log plugin entirely removes the attack vector by eliminating the vulnerable code path from execution. Additionally, enforcing strict file system permissions on the web server can limit the damage; configuring the application to run under a restricted user account with minimal write privileges ensures that even if an attacker succeeds in writing files, they cannot place them in critical system directories or overwrite essential configuration files. Regular auditing of uploaded and generated files for unexpected content types is also recommended as part of a defense-in-depth strategy.