AIKIDO-2026-403054
vrana/adminer is vulnerable to Code Injection
72
High Risk
This Affects:
vrana/adminerTL;DR
Adminer blocks SQLite ATTACH statements to prevent arbitrary file creation, but the blocklist does not cover VACUUM INTO, which writes an entire database to an arbitrary path with an arbitrary extension. An authenticated SQLite user can place content into a database and write it to the web root. When the written file is served as PHP it leads to command execution as the web-server user. The fix extends the blocklist to reject VACUUM ... INTO statements.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose the SQLite driver to users who can authenticate.
Background info
vrana/adminer is vulnerable to Code Injection in versions 0.0.1 - 5.4.2.
How to fix this
Upgrade the vrana/adminer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant