# CVE-2026-96630: AdminNeo RCE via SQLite VACUUM INTO ATTACH blocklist bypass

Source: https://junglewise.ai/threats/cve-2026-96630-adminneo-rce-via-sqlite-vacuum-into-attach-blocklist-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-96630 · Severity: high · CVSS 7.2 · Published 2026-10-30

AdminNeo is a web-based database management tool that allows authenticated users to execute SQL commands. An authenticated SQLite user can bypass the tool's ATTACH query blocklist by using VACUUM INTO to write arbitrary PHP code to the web root, creating a web shell that enables remote code execution with the privileges of the web server.

Technologies: [AdminNeo](https://junglewise.ai/threats/technologies/adminneo), [adminneo-org/adminneo (Packagist)](https://junglewise.ai/threats/technologies/adminneo-org-adminneo). Vendors: [AdminNeo](https://junglewise.ai/threats/vendors/adminneo), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-96630 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96630 being exploited in the wild.

**How severe is CVE-2026-96630?** High severity, with a CVSS score of 7.2, published 30 October 2026.

**Which products and versions are affected?** adminneo-org/adminneo (Packagist) < 5.5.1, ECOSYSTEM:introduced=0,fixed=5.5.1.

**Is there a fix for CVE-2026-96630?** Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96630 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-96630?** Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later

  ```sh
  composer require adminneo-org/adminneo:^5.5.1
  ```


## Technical details

AdminNeo blocks ATTACH queries in SQLite to prevent arbitrary file creation, but the VACUUM INTO command (available in SQLite 3.27.0+) is not blocked and achieves the same file-write result. An authenticated attacker can inject PHP code into a table name, then use VACUUM INTO to write the entire database to a PHP file in the web root, with the PHP code executed during page load. This requires prior authentication to the AdminNeo SQLite interface.

## Affected products

- AdminNeo AdminNeo

## Identifiers

- CVE-2026-96630
- GHSA-q5mp-gfjf-cf2j

## Timeline

- 2026-10-30: disclosed

## Related threats

- [AdminNeo SQLite regex backtracking filter bypass in ATTACH statement check](https://junglewise.ai/threats/cve-2026-96634-adminneo-sqlite-multi-query-incorrect-check-of-function-return)
- [AdminNeo SQLite database-list drop arbitrary file deletion](https://junglewise.ai/threats/cve-2026-96633-adminneo-sqlite-database-list-drop-arbitrary-file-deletion)
- [AdminNeo cookie attribute injection via X-Forwarded-Prefix](https://junglewise.ai/threats/cve-2026-96631-adminneo-has-cookie-attribute-injection-via-unsanitized-x)
- [AdminNeo XSS via rogue MySQL server version string (CSP nonce bypass)](https://junglewise.ai/threats/cve-2026-96632-adminneo-vulnerable-to-xss-via-rogue-mysql-server-version-string)
- [AdminNeo CSRF token vulnerability with session secret recovery](https://junglewise.ai/threats/cve-2026-96629-adminneo-csrf-token-secret-recoverable-from-single-observed-token)