CVE-2026-109347CWE-94code-injection

CVE-2026-109347

High · published October 12, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
50.3
In the wild
Unconfirmed
What it is

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00645 · 50.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-10-12T21:17Z
References (3)
https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59 · [email protected]https://www.vulncheck.com/advisories/adminer-before-6.1.1-rce-via-utf-8-bom-sqlite-attach-bypass · [email protected]https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 1%
    epss
  • 12 OCT 16:05Z
    Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass
    cvelistv5
  • 12 OCT 16:05Z
    Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass
    cvelistv5