AIKIDO-2026-362471
vrana/adminer is vulnerable to Improper Input Validation
23
Low Risk
This Affects:
vrana/adminerTL;DR
Adminer honors the client-supplied X-Forwarded-Prefix header and prepends it to the request URI that feeds the Set-Cookie Path attribute. The prefix validation only rejects values whose second character is a forward slash, so a value beginning with a backslash passes the check, and because browsers normalize backslash to forward slash the value survives as a network-path reference in the cookie path. This lets externally influenced header input produce anomalous cookie-path scoping when a proxy forwards or fails to strip the header. The fix tightens the validation so prefixes with a leading backslash are treated as invalid and ignored.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your deployment allows clients to set the X-Forwarded-Prefix header because a reverse proxy is absent or does not strip it.
Background info
vrana/adminer is vulnerable to Improper Input Validation in versions 4.6.0 - 5.5.0.
How to fix this
Upgrade the vrana/adminer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant