Is CVE-2026-59978 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59978 being exploited in the wild.

How severe is CVE-2026-59978?

High severity, with a CVSS score of 7.5, published 30 October 2026.

Which products and versions are affected?

AdminNeo up to v5.4.1; adminneo-org/adminneo (Packagist) >= 4.6.2, < 5.5.0, ECOSYSTEM:introduced=4.6.2,fixed=5.5.0.

How is CVE-2026-59978 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-59978?

Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59978: AdminNeo array injection in version endpoint causes denial of service

Q: Is there a fix for CVE-2026-59978?

Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.0 or later. Until then: Make the file adminneo.version in the temporary directory (usually the value of upload_tmp_dir) unwritable by the web server until you can upgrade. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-59978 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-59978?

Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59978 · Severity: high · CVSS 7.5 · Published 2026-10-30

AdminNeo is a database administration tool used to manage servers and applications. An unauthenticated attacker can send a specially crafted request to poison the version cache file, causing the application to crash with a fatal error on every page load for up to 24 hours. This results in a complete denial of service affecting all users of an AdminNeo instance.

Technologies: AdminNeo, adminneo-org/adminneo (Packagist). Vendors: AdminNeo, Packagist.

Quick answers

Is CVE-2026-59978 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59978 being exploited in the wild.
How severe is CVE-2026-59978?: High severity, with a CVSS score of 7.5, published 30 October 2026.
Which products and versions are affected?: AdminNeo up to v5.4.1; adminneo-org/adminneo (Packagist) >= 4.6.2, < 5.5.0, ECOSYSTEM:introduced=4.6.2,fixed=5.5.0.
Is there a fix for CVE-2026-59978?: Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.0 or later. Until then: Make the file adminneo.version in the temporary directory (usually the value of upload_tmp_dir) unwritable by the web server until you can upgrade. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59978 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-59978?: Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

adminneo-org/adminneo (Packagist): upgrade to 5.5.0 or later
```
composer require adminneo-org/adminneo:^5.5.0
```

Make the file adminneo.version in the temporary directory (usually the value of upload_tmp_dir) unwritable by the web server until you can upgrade.

Technical details

The version endpoint (?script=version) accepts POST requests without CSRF validation and does not type-check the "version" parameter before serializing it. When an attacker sends version[] as an array via POST, PHP stores the array in the cache file. Upon retrieval, the application passes this array to rawurlencode(), which expects a string, triggering a TypeError that causes HTTP 500 responses. The vulnerability requires network access to the endpoint but no authentication.

Affected products

AdminNeo AdminNeo up to v5.4.1

Identifiers

CVE-2026-59978
GHSA-jm85-8cpp-9cjc

Timeline

2026-10-30: disclosed: Vulnerability advisory GHSA-jm85-8cpp-9cjc published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.