What’s Vulnerable › Vulnerabilities

CVE-2026-34967: Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-25 · updated 2026-10-12
• Weakness: CWE-73

Description

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.

Affected products

• vrana adminer: from 5.3.0 through 5.4.2

References

• https://github.com/vrana/adminer/security/advisories/GHSA-75xm-qwfq-9wp5
• https://www.vulncheck.com/advisories/adminer-sql-log-plugin-through-arbitrary-file-write
• https://github.com/vrana/adminer/security/advisories/GHSA-75xm-qwfq-9wp5

Get alerted when CVE-2026-34967 or the next vulnerability affects your stack