Executive brief
Adminer is a popular web-based database management tool. When the optional sql-log plugin is enabled, an authenticated attacker can write arbitrary files to the server by exploiting path traversal in the schema parameter, potentially leading to denial of service through disk exhaustion or remote code execution if the attacker can place executable files in accessible directories.
Technical details
The vulnerability is a path traversal / arbitrary file write flaw in plugins/sql-log.php where the $_GET["ns"] (schema) parameter is concatenated directly into a file path without sanitization. The normal validation of this parameter (set_schema) is only applied when a database is selected; when no database is selected, validation is skipped. An authenticated attacker can log in with any self-supplied database credentials, leave the database field empty, and then submit queries with path traversal sequences in the ns parameter (e.g., ns=/../../../tmp/x) to write .sql files with attacker-controlled content to arbitrary writable paths on the server. The file is opened in append mode, allowing unbounded writes for denial of service. The vulnerability affects versions 5.3.0 through 5.4.2 when the sql-log plugin is explicitly enabled; it is patched in version 5.4.3.
Affected products
- vrana Adminer 5.3.0 through 5.4.2
Timeline
- 2026-07-09: disclosed: GitHub Security Advisory (GHSA-75xm-qwfq-9wp5) published
- 2026-08-25: other: NVD entry published as CVE-2026-34967
- 2026: patched: Patched in version 5.4.3