CVE-2026-56702

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56702
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56702.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56702
Aliases
  • GHSA-vcvj-rwwm-x6g5
Downstream
Published
2026-08-25T01:30:00.475Z
Modified
2026-08-28T03:30:28.434675583Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload
Details

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56702.json",
    "cwe_ids": [
        "CWE-434"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/vrana/adminer

Affected ranges

Type
GIT
Repo
https://github.com/vrana/adminer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
189869c4a8f0f897848cdb58493b572178084d6c
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.4.3"
        }
    ]
}

Affected versions

v3.*
v3.0.0
v3.0.1
v3.1.0
v3.2.0
v3.2.1
v3.2.2
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.4.0
v3.5.0
v3.5.1
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.7.0
v3.7.1
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.16.0
v4.17.0
v4.17.1
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.3.0
v4.3.1
v4.4.0
v4.5.0
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.7.4
v4.7.5
v4.7.7
v4.7.8
v4.7.9
v4.8.0
v4.8.1
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.1.0
v5.1.1
v5.2.0
v5.2.1
v5.3.0
v5.4.0
v5.4.1
v5.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56702.json"