Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-56705Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

Critical 9.8

In plain English

A critical-severity security flaw in adminer from vrana. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.9%top 40.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	adminer	no fix listed	DEBIAN-CVE-2026-56705
Debian:13	adminer	no fix listed	DEBIAN-CVE-2026-56705
Debian:14	adminer	5.4.3+dfsg-1	DEBIAN-CVE-2026-56705
Ubuntu:22.04:LTS	adminer	no fix listed	UBUNTU-CVE-2026-56705
Ubuntu:24.04:LTS	adminer	no fix listed	UBUNTU-CVE-2026-56705
Ubuntu:26.04:LTS	adminer	no fix listed	UBUNTU-CVE-2026-56705

Affected products (as reported)

Vendor	Product	Versions
vrana	adminer	0 – before 5.4.3

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-r4x9-5m63-3vxw) vendor-advisory
VulnCheck Advisory: Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection third-party-advisory