Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Adminer before 6.1.1 lets logged‑in users run code

CVE-2026-109347 · published 19 days ago
Summary

The web‑based database tool Adminer, versions older than 6.1.1, can be tricked by a signed‑in SQLite user to execute commands on the server. By adding a hidden character to SQL statements, an attacker can attach a malicious database file and cause the server to run PHP code as its own user. Upgrade to version 6.1.1 or later, or restrict database access to trusted users, to close the risk.

What to do
  • Update vrana adminer to version 6.1.1 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian adminer All versions
– vrana adminer < 6.1.1
Ubuntu:Pro:16.04:LTS canonical adminer All versions
Original advisory text
Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published12 Oct 2026
Updated30 Oct 2026
First seen12 Oct 2026
Sources
CVE-2026-109347 · NVD
CVE-2026-109347 · OSV
GHSA-r9r5-j5q8-8c59 · GHSA
DEBIAN-CVE-2026-109347 · OSV
CVE-2026-109347 · MITRE
UBUNTU-CVE-2026-109347 · OSV
Track software like this
Free during beta