p PatchFirst

CVE-2026-34968

CVE-2026-34968 · Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.

CVSS 7.2 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • adminer

    Versions
    • ≥ 0, < 5.4.3: Affected (semver)
    • 5.4.3: Not affected (semver)

    Update to 5.4.3

  • adminer Debian:12

    Versions
    • 4.8.1-1
    • 4.8.1-2
    • 4.8.1-4
    • 5.1.0-1
    • 5.2.1+dfsg-1
    • 5.3.0+dfsg-1
    • 5.4.0+dfsg-1
    • 5.4.1+dfsg-1
    • 5.4.2+dfsg-1
    • 5.4.3+dfsg-1
    • 5.4.4+dfsg-1
    • 6.0.0-1
    • 6.0.1-1
    • 6.0.2-1
    • 6.1.0-1
    • 6.1.1-1
    • 6.1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • adminer Debian:13

    Versions
    • 5.2.1+dfsg-1
    • 5.3.0+dfsg-1
    • 5.4.0+dfsg-1
    • 5.4.1+dfsg-1
    • 5.4.2+dfsg-1
    • 5.4.3+dfsg-1
    • 5.4.4+dfsg-1
    • 6.0.0-1
    • 6.0.1-1
    • 6.0.2-1
    • 6.1.0-1
    • 6.1.1-1
    • 6.1.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • adminer Debian:14

    Versions
    • 5.2.1+dfsg-1
    • 5.3.0+dfsg-1
    • 5.4.0+dfsg-1
    • 5.4.1+dfsg-1
    • 5.4.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 5.4.3+dfsg-1

    Update to 5.4.3+dfsg-1

  • adminer Ubuntu:Pro:16.04:LTS

    Versions
    • 4.2.1-1
    • 4.2.1-1ubuntu1
    • 4.2.1-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • adminer Ubuntu:Pro:18.04:LTS

    Versions
    • 4.3.1-2
    • 4.5.0-1
    • 4.6.1-1
    • 4.6.2-1
    • 4.6.2-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • adminer Ubuntu:Pro:20.04:LTS

    Versions
    • 4.7.2-1
    • 4.7.4-1
    • 4.7.5-1
    • 4.7.6-1
    • 4.7.6-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • adminer Ubuntu:22.04:LTS

    Versions
    • 4.7.9-2
    • 4.8.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • adminer Ubuntu:24.04:LTS

    Versions
    • 4.8.1-1
    • 4.8.1-1ubuntu1
    • 4.8.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • adminer Ubuntu:26.04:LTS

    Versions
    • 5.2.1+dfsg-1
    • 5.3.0+dfsg-1
    • 5.4.0+dfsg-1
    • 5.4.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →