Remote Code Execution Vulnerability in Adminer Package
Summary
DEBIAN-CVE-2026-109347: Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Affects adminer versions 4.8.1-1 – 6.1.2-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Adminer is a popular database management tool written in PHP, allowing users to manage databases through a web interface. It supports various database systems, including MySQL, PostgreSQL, SQLite, and more. The tool is widely used due to its simplicity and lightweight nature. However, a critical vulnerability has been identified in versions prior to 6.1.1, which exposes authenticated SQLite users to potential remote code execution risks.
Vulnerability Detail
Adminer before version 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions. This is achieved by prefixing SQL statements with a UTF-8 byte-order mark, enabling attackers to attach a database file located at a PHP-served path. They can then create a table named with PHP code, which is executed as the web server user. This vulnerability poses significant risks, including unauthorized access to sensitive data and the potential for complete server compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the Adminer interface by implementing IP whitelisting or using a VPN to limit exposure to trusted users only. Additionally, consider disabling SQLite support if it is not required for your application.
Conclusion
The remote code execution vulnerability in Adminer poses significant risks to users, particularly those utilizing SQLite. It is crucial to update to version 6.1.1 or later to safeguard against potential attacks. Implementing workarounds can provide temporary relief, but a permanent fix through updating is strongly recommended.
See every vulnerability recorded for adminer →
FAQ
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
All versions of Adminer prior to 6.1.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include unauthorized access to sensitive data, remote code execution, and complete server compromise.
Yes, you can mitigate the risk by restricting access to the Adminer interface and disabling SQLite support if it is not necessary.
References
Related vulnerabilities
Recent vulnerabilities recorded for adminer.
