Is CVE-2026-56702 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56702 being exploited in the wild.

How severe is CVE-2026-56702?

High severity, with a CVSS score of 8.8, published 25 August 2026.

Is there a fix for CVE-2026-56702?

A patch was published on 2026-07-09: Patched in Adminer 5.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56702 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56702?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56702: Adminer AdminerFileUpload PHP file upload leading to RCE

CVE-2026-56702 · Severity: high · CVSS 8.8 · Published 2026-08-25

Adminer is a web-based database management tool used for administrative access to databases. The AdminerFileUpload plugin shipped with Adminer before version 5.4.3 contains a default configuration that permits uploading PHP executable files to the web server, allowing authenticated users to upload and execute arbitrary code with the privileges of the web server process.

Quick answers

Is CVE-2026-56702 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56702 being exploited in the wild.
How severe is CVE-2026-56702?: High severity, with a CVSS score of 8.8, published 25 August 2026.
Which products and versions are affected?: vrana Adminer before 5.4.3.
Is there a fix for CVE-2026-56702?: A patch was published on 2026-07-09: Patched in Adminer 5.4.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56702 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56702?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insecure-default and unrestricted-upload issue (CWE-1188, CWE-434) in the AdminerFileUpload plugin. The plugin accepts file uploads for columns ending in _path and uses a default extension allowlist of [a-zA-Z0-9]+, which matches executable extensions including php, phtml, phar, and mixed-case variants. The validation regex ~(\.($this->extensions))?$~ anchors an optional group at end-of-string, meaning it never rejects any filename—it only strips the extension when a restrictive allowlist is configured. An authenticated user, including low-privilege Adminer Editor end-users, can upload a PHP webshell. When uploadPath is web-served as a PHP-executable directory (the plugin's documented configuration), the attacker gains remote code execution as the web-server user. The vulnerability requires authentication but no special privileges or user interaction. A patch is available in Adminer 5.4.3 and later, and the issue is resolved by configuring a restrictive extensions allowlist.

Affected products

vrana Adminer before 5.4.3

Timeline

2026-07-09: advisory: GitHub Security Advisory (GHSA-vcvj-rwwm-x6g5) published
2026-08-25: disclosed: CVE-2026-56702 published on NVD
2026-07-09: patched: Patched in Adminer 5.4.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.