# CVE-2026-59978: AdminNeo array injection in version endpoint causes denial of service

Source: https://junglewise.ai/threats/cve-2026-59978-adminneo-version-cache-array-injection-causes-persistent-denial  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-59978 · Severity: high · CVSS 7.5 · Published 2026-10-30

AdminNeo is a database administration tool used to manage servers and applications. An unauthenticated attacker can send a specially crafted request to poison the version cache file, causing the application to crash with a fatal error on every page load for up to 24 hours. This results in a complete denial of service affecting all users of an AdminNeo instance.

Technologies: [AdminNeo](https://junglewise.ai/threats/technologies/adminneo), [adminneo-org/adminneo (Packagist)](https://junglewise.ai/threats/technologies/adminneo-org-adminneo). Vendors: [AdminNeo](https://junglewise.ai/threats/vendors/adminneo), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-59978 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59978 being exploited in the wild.

**How severe is CVE-2026-59978?** High severity, with a CVSS score of 7.5, published 30 October 2026.

**Which products and versions are affected?** AdminNeo up to v5.4.1; adminneo-org/adminneo (Packagist) >= 4.6.2, < 5.5.0, ECOSYSTEM:introduced=4.6.2,fixed=5.5.0.

**Is there a fix for CVE-2026-59978?** Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.0 or later. Until then: Make the file adminneo.version in the temporary directory (usually the value of upload_tmp_dir) unwritable by the web server until you can upgrade. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59978 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-59978?** Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- adminneo-org/adminneo (Packagist): upgrade to 5.5.0 or later

  ```sh
  composer require adminneo-org/adminneo:^5.5.0
  ```


Make the file adminneo.version in the temporary directory (usually the value of upload_tmp_dir) unwritable by the web server until you can upgrade.

## Technical details

The version endpoint (?script=version) accepts POST requests without CSRF validation and does not type-check the "version" parameter before serializing it. When an attacker sends version[] as an array via POST, PHP stores the array in the cache file. Upon retrieval, the application passes this array to rawurlencode(), which expects a string, triggering a TypeError that causes HTTP 500 responses. The vulnerability requires network access to the endpoint but no authentication.

## Affected products

- AdminNeo AdminNeo up to v5.4.1

## Identifiers

- CVE-2026-59978
- GHSA-jm85-8cpp-9cjc

## Timeline

- 2026-10-30: disclosed: Vulnerability advisory GHSA-jm85-8cpp-9cjc published

## Related threats

- [AdminNeo SQLite regex backtracking filter bypass in ATTACH statement check](https://junglewise.ai/threats/cve-2026-96634-adminneo-sqlite-multi-query-incorrect-check-of-function-return)
- [AdminNeo SQLite database-list drop arbitrary file deletion](https://junglewise.ai/threats/cve-2026-96633-adminneo-sqlite-database-list-drop-arbitrary-file-deletion)
- [AdminNeo cookie attribute injection via X-Forwarded-Prefix](https://junglewise.ai/threats/cve-2026-96631-adminneo-has-cookie-attribute-injection-via-unsanitized-x)
- [AdminNeo XSS via rogue MySQL server version string (CSP nonce bypass)](https://junglewise.ai/threats/cve-2026-96632-adminneo-vulnerable-to-xss-via-rogue-mysql-server-version-string)
- [AdminNeo RCE via SQLite VACUUM INTO ATTACH blocklist bypass](https://junglewise.ai/threats/cve-2026-96630-adminneo-rce-via-sqlite-vacuum-into-attach-blocklist-bypass)