Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by VulDB

CVE-2026-121263phpMyAdmin MoTranslator Loader.php getTranslator path traversal

Medium 6.3

In plain English

A medium-severity path traversal in MoTranslator from phpMyAdmin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.5%top 59.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12phpmyadmin-motranslatorno fix listedDEBIAN-CVE-2026-121263
Debian:13phpmyadmin-motranslatorno fix listedDEBIAN-CVE-2026-121263
Debian:14phpmyadmin-motranslatorno fix listedDEBIAN-CVE-2026-121263
Ubuntu:22.04:LTSphpmyadminno fix listedUBUNTU-CVE-2026-121263
Ubuntu:24.04:LTSphpmyadminno fix listedUBUNTU-CVE-2026-121263
Ubuntu:26.04:LTSphpmyadminno fix listedUBUNTU-CVE-2026-121263
Ubuntu:26.10phpmyadminno fix listedUBUNTU-CVE-2026-121263

Affected products (as reported)

VendorProductVersions
phpMyAdmin MoTranslator 6.0.06.0.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References