CVE-2026-56703CWE-94code-injection

CVE-2026-56703

High · published August 25, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
67.2
In the wild
Unconfirmed
What it is

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.01171 · 67.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-25T06:16Z
References (3)
https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf · [email protected]https://www.vulncheck.com/advisories/adminer-before-remote-code-execution-via-sqlite-vacuum-into · [email protected]https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 26 AUG 08:15Z
    EPSS moved — → 1%
    epss
  • 25 AUG 01:30Z
    Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO
    cvelistv5