Executive brief
Adminer is a web-based database management tool used for administrative access to databases. The AdminerFileUpload plugin shipped with Adminer before version 5.4.3 contains a default configuration that permits uploading PHP executable files to the web server, allowing authenticated users to upload and execute arbitrary code with the privileges of the web server process.
Technical details
The vulnerability is an insecure-default and unrestricted-upload issue (CWE-1188, CWE-434) in the AdminerFileUpload plugin. The plugin accepts file uploads for columns ending in _path and uses a default extension allowlist of [a-zA-Z0-9]+, which matches executable extensions including php, phtml, phar, and mixed-case variants. The validation regex ~(\.($this->extensions))?$~ anchors an optional group at end-of-string, meaning it never rejects any filename—it only strips the extension when a restrictive allowlist is configured. An authenticated user, including low-privilege Adminer Editor end-users, can upload a PHP webshell. When uploadPath is web-served as a PHP-executable directory (the plugin's documented configuration), the attacker gains remote code execution as the web-server user. The vulnerability requires authentication but no special privileges or user interaction. A patch is available in Adminer 5.4.3 and later, and the issue is resolved by configuring a restrictive extensions allowlist.
Affected products
- vrana Adminer before 5.4.3
Timeline
- 2026-07-09: advisory: GitHub Security Advisory (GHSA-vcvj-rwwm-x6g5) published
- 2026-08-25: disclosed: CVE-2026-56702 published on NVD
- 2026-07-09: patched: Patched in Adminer 5.4.3