Adminer CVE-2026-109347

Requires an authenticated Adminer session (PR:H) with access to a SQLite database, where the attacker can submit SQL statements. The attacker must be able to attach/write a database file to a filesystem path that is served and executed as PHP by the web server (i.e., a web-accessible, server-writable directory), and the SQLite driver must be in use. Exploitation is LIMITED by: valid authenticated credentials with SQLite access, the target using SQLite rather than another engine, and the existence of a PHP-executing writable path reachable over the web; it does not affect non-SQLite deployments and is not exploitable pre-authentication.

Only a CVSS 4.0 vector is provided (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), rated 8.6; no CVSS 3.1 vector, no EPSS score, and no SSVC decision data accompany the input, so quantitative exploitation-probability signals are MISSING and cannot be weighed. The vector indicates a network-reachable attack (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but PR:H confirms the attacker must already hold a privileged, authenticated Adminer session with SQLite access - this is an authenticated post-login flaw, not an unauthenticated internet-facing one, which materially lowers real-world risk versus the headline 8.6. There is no CISA KEV listing and no indication of public POC code, so this is 'no public exploit identified at time of analysis' rather than confirmed active exploitation. Net assessment: a genuine high-impact RCE (full VC/VI/VA High, code execution as the web server user) that is a real priority for any environment exposing Adminer with SQLite to semi-trusted users, but the PR:H precondition and absence of KEV/EPSS/POC signals make widespread opportunistic exploitation less likely than a targeted, insider-or-compromised-credential scenario.

An attacker who already has authenticated access to an Adminer instance managing a SQLite database prefixes an ATTACH/VACUUM INTO statement with a UTF-8 byte-order mark to slip past Adminer's input restrictions, attaching a database file to a web-served PHP path and creating a table whose name contains PHP code. When that PHP path is requested over the web, the injected code runs as the web server user, yielding remote code execution. No public exploit code is identified at time of analysis, but the technique is fully described in the VulnCheck and GHSA advisories.