CVE-2026-56705: Pre-Authentication RCE in Adminer's MSSQL Database Driver

Remote code execution in Adminer before 5.4.3 allows authenticated attackers connected to a SQLite database to write arbitrary PHP files to server-accessible paths and execute OS commands. The vulnerability exploits an incomplete command denylist: while Adminer restricts the ATTACH statement to limit direct file access, the VACUUM INTO command - which writes the current SQLite database to an arbitrary file path - was not blocked. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exploit mechanism is straightforward for any authenticated user with SQLite access.

Arbitrary file deletion in Adminer before 5.4.3 exposes any file writable by the PHP process to authenticated attackers operating in SQLite mode by abusing unvalidated relative path input in the db[] parameter during database drop operations. The root cause is a missing file extension check in the SQLite drop action (CWE-22 path traversal), allowing directory traversal sequences to escape the intended SQLite database directory. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the deterministic nature of path traversal exploitation makes the vulnerability straightforward to weaponize once authenticated access is obtained.

Unrestricted PHP file upload in Adminer's AdminerFileUpload plugin (versions before 5.4.3) allows any authenticated low-privilege user to deploy a webshell and execute arbitrary code as the web-server user. The root cause is a permissive default extension allowlist that fails to block .php uploads to columns with _path suffixes when the uploadPath directory is web-served. No public exploit has been identified at time of analysis, but the attack chain is technically trivial for anyone with Adminer credentials and requires no user interaction.

Server-side request forgery in Adminer before 5.5.0 allows unauthenticated remote attackers to probe arbitrary internal hosts and ports by injecting PDO DSN keys into the login form's server parameter. The root cause is an incomplete port-validation routine that only inspects leading numeric characters, failing to reject non-numeric port values; a crafted server string such as 'host=internal.host port=6379' bypasses the privileged-port restriction entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the pre-authentication nature and low attack complexity make this an attractive reconnaissance primitive against Adminer deployments exposed to untrusted networks.

Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single valid token to recover the session secret with one XOR operation, then forge unlimited valid CSRF tokens indefinitely. The token format `(rand XOR secret):rand` transmits both XOR operands together, rendering the masking scheme arithmetically transparent; this flaw is compounded by approximately 20 bits of entropy in the underlying random value and PHP loose comparison in token verification. Successful exploitation permits CSRF attacks against authenticated Adminer sessions, enabling execution of arbitrary SQL queries including data exfiltration, unauthorized modification, and destructive operations. No public exploit has been identified at time of analysis.

Arbitrary file write in Adminer 5.3.0-5.4.2 allows any authenticated user to write attacker-controlled content to arbitrary writable filesystem paths via path traversal in the ns parameter of the sql-log plugin. The written files are constrained to a .sql extension, which limits but does not eliminate the integrity impact - an attacker can overwrite existing .sql files, pollute backup directories, or write large files to fill disk. No public exploit code or CISA KEV listing has been identified at time of analysis, and the attack surface is narrowed by both the authentication requirement and the non-default plugin dependency.

Adminer 4.6.0 through 5.4.x blindly prepends the client-supplied X-Forwarded-Prefix HTTP header to internally constructed URLs with no trusted-proxy allowlist or value sanitization, allowing attacker-controlled URL prefixes to propagate into Location redirect headers, Set-Cookie path attributes, and self-referential links. This yields an authenticated open redirect on state-changing POSTs and unauthenticated control of session cookie path scoping against default deployments in the affected version range. CR/LF injection is blocked, ruling out header splitting and XSS despite the intelligence source's XSS tag - that tag appears to be a mis-classification and should not inflate risk estimates. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.

Cross-site scripting with CSP bypass in Adminer before 5.4.3 enables arbitrary JavaScript execution in the browser of any user who connects to an attacker-controlled MySQL server. The vulnerability stems from unsanitized MySQL server version strings being injected directly into script tags that carry valid Content Security Policy nonces, effectively nullifying CSP protections. No public exploit code or CISA KEV entry has been identified at time of analysis, but the attack is meaningful against administrators and developers who routinely connect Adminer instances to external or third-party MySQL servers.