CVE-2026-109347: Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-16
Weakness: CWE-94

Description

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.

Affected products

vrana adminer: before 6.1.1 — fixed in 6.1.1

How to fix

Upgrade to a fixed version: vrana adminer 6.1.1. Check the vendor advisory for mitigations.

References

https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59
https://www.vulncheck.com/advisories/adminer-before-6.1.1-rce-via-utf-8-bom-sqlite-attach-bypass
https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59

Get alerted when CVE-2026-109347 or the next vulnerability affects your stack