AIKIDO-2026-597919
vrana/adminer is vulnerable to Server-Side Request Forgery (SSRF)
69
Medium Risk
This Affects:
vrana/adminerTL;DR
Adminer enforces its privileged-port restriction using the port returned by host_port(), which yields an empty port for server values it does not recognize, so the check is skipped for those values. The default MySQL/MariaDB driver then reparses the port out of the raw host string and connects anyway, letting an unauthenticated visitor use the login form to open TCP connections to internal hosts, including privileged ports, and read the resulting connection errors as a blind reachability oracle. The fix parses the server value with parse_server() so it is structurally validated and normalized before any connection is attempted.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you expose the default MySQL/MariaDB login driver to untrusted users
Background info
vrana/adminer is vulnerable to Server-Side Request Forgery (SSRF) in versions 5.5.1 - 6.0.1.
How to fix this
Upgrade the vrana/adminer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.