Is CVE-2026-96634 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96634 being exploited in the wild.

How severe is CVE-2026-96634?

Medium severity, with a CVSS score of 4, published 30 October 2026.

Which products and versions are affected?

adminneo-org/adminneo (Packagist) < 5.5.1, ECOSYSTEM:introduced=0,fixed=5.5.1.

Is there a fix for CVE-2026-96634?

Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96634 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-96634?

Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96634: AdminNeo SQLite regex backtracking filter bypass in ATTACH statement check

Q: Is there a fix for CVE-2026-96634?

Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96634 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-96634?

Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96634 · Severity: medium · CVSS 4 · Published 2026-10-30

AdminNeo is a database management web application that allows users to import SQL files. A flaw in the security filter that blocks dangerous ATTACH statements can be bypassed by uploading a specially crafted SQL file with many comment lines, allowing an attacker to create arbitrary PHP files and achieve remote code execution on the server.

Technologies: AdminNeo, adminneo-org/adminneo (Packagist). Vendors: AdminNeo, Packagist.

Quick answers

Is CVE-2026-96634 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96634 being exploited in the wild.
How severe is CVE-2026-96634?: Medium severity, with a CVSS score of 4, published 30 October 2026.
Which products and versions are affected?: adminneo-org/adminneo (Packagist) < 5.5.1, ECOSYSTEM:introduced=0,fixed=5.5.1.
Is there a fix for CVE-2026-96634?: Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96634 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-96634?: Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later
```
composer require adminneo-org/adminneo:^5.5.1
```

Technical details

The vulnerability is a regex catastrophic backtracking bypass in the ATTACH statement filter. When processing a malicious SQL file with approximately 350,000 SQLite comment lines, the possessive quantifier in the regex pattern causes exponential backtracking, causing preg_match() to return false instead of 0 or 1. The code treats false as "no match," allowing the ATTACH query to bypass the security filter and be executed, enabling file creation with embedded PHP code.

Affected products

AdminNeo AdminNeo

Identifiers

CVE-2026-96634
GHSA-p96f-p2p2-2g3h

Timeline

2026-10-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.