# CVE-2026-15686: Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution

Source: https://junglewise.ai/threats/cve-2026-15686-adminer-multi-query-incorrect-check-of-function-return-value  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-15686 · Severity: high · CVSS 7.2 · Published 2026-08-20

Adminer is a web-based database management tool used to administer databases like SQLite, MySQL, and PostgreSQL. This vulnerability allows authenticated users to upload a malicious SQL file through the import feature that, when processed, creates PHP files executable by the web server, leading to complete code execution. An attacker with database access credentials can use this to establish persistent access to the underlying web server and compromise the entire system.

Technologies: [Adminer](https://junglewise.ai/threats/technologies/adminer). Vendors: [Adminer](https://junglewise.ai/threats/vendors/adminer).

## Quick answers

**Is CVE-2026-15686 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15686 being exploited in the wild.

**How severe is CVE-2026-15686?** High severity, with a CVSS score of 7.2, published 20 August 2026.

**Which products and versions are affected?** Adminer 5.4.2.

**Is there a fix for CVE-2026-15686?** A patch was published on 2026-07-29: Coordinated public release of advisory; Adminer 5.4.3 issued with patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15686 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-15686?** Check whether you run Adminer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a patch bypass vulnerability (CVE-2026-15686) that exploits catastrophic backtracking in a regular expression designed to block SQLite ATTACH statements. The vulnerable code in sql.inc.php uses a possessive quantifier (*+) in the regex filter that, when processing a SQL file containing approximately 350,000 SQLite comment lines (--), causes PHP's preg_match() function to hit its backtracking limit and return false instead of 0 or 1. The code incorrectly treats false as equivalent to "no match," allowing the malicious ATTACH statement to bypass the security filter. An authenticated attacker can exploit this during the SQL import process by uploading a crafted SQL file that creates a .php file with embedded PHP code. The vulnerability is present in Adminer 5.4.2 and was patched in 5.4.3. Authentication to the database is required, but this is often the default password or publicly known credentials in development environments.

## Affected products

- Adminer Adminer 5.4.2

## Timeline

- 2026-03-06: disclosed: Vulnerability reported to vendor
- 2026-07-29: patched: Coordinated public release of advisory; Adminer 5.4.3 issued with patch
- 2026-07-29: advisory: ZDI-26-478 published
- 2026-08-20: other: CVE-2026-15686 published

## References

- [https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7](https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-478/](https://www.zerodayinitiative.com/advisories/ZDI-26-478/)

## Related threats

- [Adminer server-side request forgery in ClickHouse driver](https://junglewise.ai/threats/cve-2026-100697-adminer-6-0-0-through-6-0-1-when-the-official-clickhouse-driver)
- [Adminer cross-site scripting via MySQL version string](https://junglewise.ai/threats/cve-2026-56704-adminer-cross-site-scripting-via-mysql-version-string)
- [Adminer remote code execution via SQLite VACUUM INTO](https://junglewise.ai/threats/cve-2026-56703-adminer-remote-code-execution-via-sqlite-vacuum-into)
- [Adminer server field SSRF via PDO DSN injection](https://junglewise.ai/threats/cve-2026-34964-adminer-server-field-ssrf-via-pdo-dsn-injection)
- [SSRF in adminer](https://junglewise.ai/threats/cve-2021-21311-adminer-ssrf-in-database-driver-bundling)