Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-56702: Adminer before 5.4.3 lets logged‑in users upload malicious scripts
CVE-2026-56702 · published 2 months ago
Summary
Versions of Adminer earlier than 5.4.3 allow anyone with an account to place their own code on the server through a file‑upload feature. This could let an attacker run commands as the web server, potentially compromising the whole site. Update Adminer to version 5.4.3 or later, or disable the file‑upload plugin and restrict which file types can be uploaded.
What to do
- Update debian adminer to version 5.4.3+dfsg-1.
- Update vrana adminer to version 5.4.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:Pro:16.04:LTS | canonical | adminer | All versions |
| – | vrana | adminer | < 5.4.3 |
| Debian:11 | debian | adminer | All versions |
| Debian:12 | debian | adminer | All versions |
| Debian:13 | debian | adminer | All versions |
| Debian:14 | debian | adminer |
< 5.4.3+dfsg-1 Fix: upgrade to 5.4.3+dfsg-1
|
Original advisory text
Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload
Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.
References
- https://www.vulncheck.com/advisories/adminer-before-unrestricted-file-upload-via... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56702... Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-56702 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56702 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-56702 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-56702 Third Party Advisory
- https://github.com/vrana/adminer/security/advisories/GHSA-vcvj-rwwm-x6g5 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-434Unrestricted File Upload
Timeline
Published25 Aug 2026
Updated4 Nov 2026
First seen25 Aug 2026
Sources
DEBIAN-CVE-2026-56702 · OSV
CVE-2026-56702 · NVD
CVE-2026-56702 · MITRE
CVE-2026-56702 · OSV
GHSA-vcvj-rwwm-x6g5 · GHSA
UBUNTU-CVE-2026-56702 · OSV
Track software like this
Free during beta