Vulnerability · Published Nov 3, 2026 · Assigned by VulDB

CVE-2026-121261phpMyAdmin ShapeFile SHP File loadFromFile infinite loop

Medium 4.3

In plain English

A medium-severity infinite loop in ShapeFile from phpMyAdmin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 77.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	phpmyadmin	no fix listed	UBUNTU-CVE-2026-121261
Ubuntu:24.04:LTS	phpmyadmin	no fix listed	UBUNTU-CVE-2026-121261
Ubuntu:26.04:LTS	phpmyadmin	no fix listed	UBUNTU-CVE-2026-121261
Ubuntu:26.10	phpmyadmin	no fix listed	UBUNTU-CVE-2026-121261

Affected products (as reported)

Vendor	Product	Versions
phpMyAdmin	ShapeFile	4.0.04.0.1

Weakness: CWE-835, CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

References

VDB-430227 | phpMyAdmin ShapeFile SHP File loadFromFile infinite loop vdb-entry, technical-description
VDB-430227 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-121261 | CVE Analysis and Report third-party-advisory
Submit #1018488 | phpMyAdmin ShapeFile 4.0.1 CWE-835 -Infinite Loop in ShapeRecord::loadFromFile third-party-advisory
https://gist.github.com/Ishanoshada/efbda3b5bee92058cc6b08f67d4e7363 exploit