AIKIDO-2026-820389

TL;DR

Adminer's SQLite filter blocks ATTACH and VACUUM INTO statements with a regex that only matches the keyword after Adminer's own notion of whitespace or comments, before the query reaches connection()->multi_query($q). A statement prefixed with a UTF-8 byte order mark (EF BB BF) does not match that regex, but SQLite strips the BOM and runs the statement anyway. An authenticated SQLite user can use ATTACH DATABASE to create a SQLite file at an arbitrary PHP writable path and embed PHP code in a table name, which runs when that path is requested through the web server. The fix adds a SQLite authorizer that rejects file writing ATTACH and VACUUM INTO operations regardless of a BOM prefix.