AIKIDO-2026-365818

TL;DR

Adminer's SQLite database-list drop action passes submitted database names to unlink() without the extension validation applied to create and rename operations. An authenticated SQLite user with a valid request token can submit an arbitrary file path in the db[] field and delete any file writable by the PHP process. The submitted path is not bound to a known SQLite database, so files outside the intended directory can be removed. The fix validates the filename before deletion.