CVE-2026-56703

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-56703
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56703.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-56703
Aliases
  • GHSA-gmx3-g29w-77wf
Downstream
Published
2026-08-25T01:30:01.161Z
Modified
2026-08-25T04:03:23.653790324Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO
Details

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56703.json"
}
References

Affected packages

Git / github.com/vrana/adminer

Affected ranges

Type
GIT
Repo
https://github.com/vrana/adminer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
189869c4a8f0f897848cdb58493b572178084d6c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.4.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v3.*
v3.0.0
v3.0.1
v3.1.0
v3.2.0
v3.2.1
v3.2.2
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.4.0
v3.5.0
v3.5.1
v3.6.0
v3.6.1
v3.6.2
v3.6.3
v3.6.4
v3.7.0
v3.7.1
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.1.0
v4.16.0
v4.17.0
v4.17.1
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.3.0
v4.3.1
v4.4.0
v4.5.0
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.7.4
v4.7.5
v4.7.7
v4.7.8
v4.7.9
v4.8.0
v4.8.1
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.1.0
v5.1.1
v5.2.0
v5.2.1
v5.3.0
v5.4.0
v5.4.1
v5.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56703.json"