Is CVE-2026-121263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121263 being exploited in the wild.

How severe is CVE-2026-121263?

Medium severity, with a CVSS score of 6.3, published 3 November 2026.

Which products and versions are affected?

phpMyAdmin MoTranslator up to 6.0.1.

How is CVE-2026-121263 attacked?

It is attacked over the network.

Am I affected by CVE-2026-121263?

Check whether you run phpMyAdmin MoTranslator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121263: phpMyAdmin MoTranslator path traversal in locale handling

CVE-2026-121263 · Severity: medium · CVSS 6.3 · Published 2026-11-03

phpMyAdmin MoTranslator is a translation library used by phpMyAdmin and other applications to load localized content. A path traversal vulnerability in the locale parameter allows an attacker to load translation files from outside the intended directory, potentially injecting malicious translations that could lead to phishing, spoofing, or stored cross-site scripting attacks if the application renders translations without escaping.

Vendors: phpMyAdmin.

Quick answers

Is CVE-2026-121263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121263 being exploited in the wild.
How severe is CVE-2026-121263?: Medium severity, with a CVSS score of 6.3, published 3 November 2026.
Which products and versions are affected?: phpMyAdmin MoTranslator up to 6.0.1.
Is there a fix for CVE-2026-121263?: No fixed version is recorded yet. Validate and normalize locale strings before passing them to the translator, rejecting any input containing path traversal sequences like .. or /. Alternatively, use realpath() to verify that the resolved translation file path remains within the configured locale root directory before loading it. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121263 attacked?: It is attacked over the network.
Am I affected by CVE-2026-121263?: Check whether you run phpMyAdmin MoTranslator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Validate and normalize locale strings before passing them to the translator, rejecting any input containing path traversal sequences like .. or /. Alternatively, use realpath() to verify that the resolved translation file path remains within the configured locale root directory before loading it.

Technical details

The vulnerability exists in Loader::getTranslator() which concatenates an attacker-controlled locale string into a filesystem path without validating the result against the configured locale root. By supplying a locale like "../evil", an attacker can traverse outside the intended locale directory and load a crafted .mo translation file, gaining control over translation strings returned to the application. The fix requires realpath() containment checks to ensure the resolved path remains within the configured base directory.

Affected products

phpMyAdmin MoTranslator up to 6.0.1

Timeline

2026-10-07: disclosed: Vulnerability disclosed on GitHub gist
2026-11-03: advisory: CVE-2026-121263 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.