AIKIDO-2026-525866
vrana/adminer is vulnerable to Code Injection
72
High Risk
This Affects:
vrana/adminerTL;DR
Adminer filters SQLite ATTACH statements during SQL import using a regular expression whose result is treated as a simple match or no-match. Supplying a query padded with a very large number of SQLite comment lines drives the regular expression into huge backtracking, so the match function returns a failure value that the code treats as no match, bypassing the blocklist. The ATTACH statement then executes, allowing creation of a PHP file and code execution for an authenticated user. The fix checks the match result explicitly and extends the blocklist.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose the SQLite driver with SQL import to users who can authenticate.
Background info
vrana/adminer is vulnerable to Code Injection in versions 4.2.4 - 5.4.2.
How to fix this
Upgrade the vrana/adminer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant