CVE-2026-16434
CVE-2026-16434 · Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guard (bootstrap.inc.php) only rejects prefixes matching ^/[^/], blocking //evil.com but allowing values such as /\evil.com whose second character is a backslash. Because browsers normalize backslash to forward slash, a network-path reference survives into REQUEST_URI and reaches cookie_path(), affecting the Set-Cookie Path attribute. Exploitation requires that clients can set the X-Forwarded-Prefix header (a misconfigured or absent reverse proxy). Impact is limited to anomalous cookie-path scoping.
CVSS 2.3 · Low · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
adminer
- Versions
- ≥ 0, < 5.5.1: Affected (semver)
- 5.5.1: Not affected (semver)
Update to 5.5.1
adminer Debian:12
- Versions
- 4.8.1-1
- 4.8.1-2
- 4.8.1-4
- 5.1.0-1
- 5.2.1+dfsg-1
- 5.3.0+dfsg-1
- 5.4.0+dfsg-1
- 5.4.1+dfsg-1
- 5.4.2+dfsg-1
- 5.4.3+dfsg-1
- 5.4.4+dfsg-1
- 6.0.0-1
- 6.0.1-1
- 6.0.2-1
- 6.1.0-1
- 6.1.1-1
- 6.1.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
adminer Debian:13
- Versions
- 5.2.1+dfsg-1
- 5.3.0+dfsg-1
- 5.4.0+dfsg-1
- 5.4.1+dfsg-1
- 5.4.2+dfsg-1
- 5.4.3+dfsg-1
- 5.4.4+dfsg-1
- 6.0.0-1
- 6.0.1-1
- 6.0.2-1
- 6.1.0-1
- 6.1.1-1
- 6.1.2-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
adminer Debian:14
- Versions
- 5.2.1+dfsg-1
- 5.3.0+dfsg-1
- 5.4.0+dfsg-1
- 5.4.1+dfsg-1
- 5.4.2+dfsg-1
- 5.4.3+dfsg-1
- 5.4.4+dfsg-1
- Affected ranges
- ECOSYSTEM: < 6.0.0-1
Update to 6.0.0-1
adminer Ubuntu:Pro:16.04:LTS
- Versions
- 4.2.1-1
- 4.2.1-1ubuntu1
- 4.2.1-1ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
adminer Ubuntu:Pro:18.04:LTS
- Versions
- 4.3.1-2
- 4.5.0-1
- 4.6.1-1
- 4.6.2-1
- 4.6.2-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
adminer Ubuntu:Pro:20.04:LTS
- Versions
- 4.7.2-1
- 4.7.4-1
- 4.7.5-1
- 4.7.6-1
- 4.7.6-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
adminer Ubuntu:22.04:LTS
- Versions
- 4.7.9-2
- 4.8.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
adminer Ubuntu:24.04:LTS
- Versions
- 4.8.1-1
- 4.8.1-1ubuntu1
- 4.8.1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
adminer Ubuntu:26.04:LTS
- Versions
- 5.2.1+dfsg-1
- 5.3.0+dfsg-1
- 5.4.0+dfsg-1
- 5.4.1+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published