CVE-2026-56703: Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-25 · updated 2026-10-12
Weakness: CWE-94

Description

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.

Affected products

vrana adminer: before 5.4.3 — fixed in 5.4.3

How to fix

Upgrade to a fixed version: vrana adminer 5.4.3. Check the vendor advisory for mitigations.

References

https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf
https://www.vulncheck.com/advisories/adminer-before-remote-code-execution-via-sqlite-vacuum-into
https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf

Get alerted when CVE-2026-56703 or the next vulnerability affects your stack