Is CVE-2026-96630 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96630 being exploited in the wild.

How severe is CVE-2026-96630?

High severity, with a CVSS score of 7.2, published 30 October 2026.

Which products and versions are affected?

adminneo-org/adminneo (Packagist) < 5.5.1, ECOSYSTEM:introduced=0,fixed=5.5.1.

Is there a fix for CVE-2026-96630?

Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96630 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-96630?

Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96630: AdminNeo RCE via SQLite VACUUM INTO ATTACH blocklist bypass

Q: Is there a fix for CVE-2026-96630?

Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96630 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-96630?

Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96630 · Severity: high · CVSS 7.2 · Published 2026-10-30

AdminNeo is a web-based database management tool that allows authenticated users to execute SQL commands. An authenticated SQLite user can bypass the tool's ATTACH query blocklist by using VACUUM INTO to write arbitrary PHP code to the web root, creating a web shell that enables remote code execution with the privileges of the web server.

Technologies: AdminNeo, adminneo-org/adminneo (Packagist). Vendors: AdminNeo, Packagist.

Quick answers

Is CVE-2026-96630 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96630 being exploited in the wild.
How severe is CVE-2026-96630?: High severity, with a CVSS score of 7.2, published 30 October 2026.
Which products and versions are affected?: adminneo-org/adminneo (Packagist) < 5.5.1, ECOSYSTEM:introduced=0,fixed=5.5.1.
Is there a fix for CVE-2026-96630?: Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96630 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-96630?: Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later
```
composer require adminneo-org/adminneo:^5.5.1
```

Technical details

AdminNeo blocks ATTACH queries in SQLite to prevent arbitrary file creation, but the VACUUM INTO command (available in SQLite 3.27.0+) is not blocked and achieves the same file-write result. An authenticated attacker can inject PHP code into a table name, then use VACUUM INTO to write the entire database to a PHP file in the web root, with the PHP code executed during page load. This requires prior authentication to the AdminNeo SQLite interface.

Affected products

AdminNeo AdminNeo

Identifiers

CVE-2026-96630
GHSA-q5mp-gfjf-cf2j

Timeline

2026-10-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.