# CVE-2026-109347: Adminer remote code execution via UTF-8 BOM bypass in SQLite

Source: https://junglewise.ai/threats/cve-2026-109347-adminer-before-6-1-1-contains-a-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109347 · Severity: high · CVSS 7.2 · Published 2026-10-12

Adminer is a web-based database management tool used by developers to manage databases including SQLite. An authenticated attacker with SQLite database access can bypass security restrictions by using a special UTF-8 byte-order mark character, allowing them to create executable PHP code files on the web server, leading to complete compromise of the server running as the web server user.

Technologies: [Vrana Adminer](https://junglewise.ai/threats/technologies/vrana-adminer). Vendors: [Vrana](https://junglewise.ai/threats/vendors/vrana).

## Quick answers

**Is CVE-2026-109347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109347 being exploited in the wild.

**How severe is CVE-2026-109347?** High severity, with a CVSS score of 7.2, published 12 October 2026.

**Which products and versions are affected?** Vrana Adminer before 6.1.1.

**Is there a fix for CVE-2026-109347?** Yes: fixed in 6.1.1. Until then: Upgrade to Adminer 6.1.1 or restrict SQLite database access to trusted users only and ensure the PHP process cannot write to web-accessible directories. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-109347 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-109347?** Check whether you run Vrana Adminer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.1.1

Upgrade to Adminer 6.1.1 or restrict SQLite database access to trusted users only and ensure the PHP process cannot write to web-accessible directories.

## Technical details

The vulnerability exists in Adminer's SQL statement filtering for SQLite, which uses regex to block dangerous ATTACH and VACUUM INTO statements but fails to normalize UTF-8 byte-order marks (BOM: EF BB BF) before pattern matching. An authenticated user can prefix these SQL commands with a BOM to bypass the filter; SQLite then strips the BOM and executes the statement. An attacker can use ATTACH to create a database file in a web-accessible PHP directory and CREATE TABLE with PHP code in the table name to achieve remote code execution as the web server user.

## Affected products

- vrana Adminer before 6.1.1

## Timeline

- 2026-09-25: disclosed
- 2026-10-12: advisory

## References

- [https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59](https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59)
- [https://www.vulncheck.com/advisories/adminer-before-6.1.1-rce-via-utf-8-bom-sqlite-attach-bypass](https://www.vulncheck.com/advisories/adminer-before-6.1.1-rce-via-utf-8-bom-sqlite-attach-bypass)

## Related threats

- [Adminer server-side request forgery via host_port regex bypass](https://junglewise.ai/threats/cve-2026-100698-adminer-5-5-1-through-6-0-1-improperly-parses-the-login-server)
- [Adminer cross-site scripting in CONNECTION_ID interpolation](https://junglewise.ai/threats/cve-2026-100695-adminer-before-6-0-2-contains-a-cross-site-scripting)