CVE-2026-56705CWE-73

CVE-2026-56705

Critical · published August 25, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00895 · 59.1th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-08-25T06:16Z
References (3)
https://github.com/vrana/adminer/security/advisories/GHSA-r4x9-5m63-3vxw · [email protected]https://www.vulncheck.com/advisories/adminer-before-remote-code-execution-via-mssql-pdo-dsn-injection · [email protected]https://github.com/vrana/adminer/security/advisories/GHSA-r4x9-5m63-3vxw · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 26 AUG 08:15Z
    EPSS moved — → 0%
    epss
  • 25 AUG 01:30Z
    Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection
    cvelistv5