phpMyAdmin CVE-2026-119428

Requires that the phpMyAdmin setup/validate.php endpoint is network-reachable by the attacker; the vulnerability exists because validate.php lacks the setup-disabled guard, so the probe path remains exposed even in deployments that believe setup is disabled. No authentication is required (PR:N). The exploit is a blind/semi-blind SSRF constrained to outbound MySQL-protocol connections, and the attacker's gain is limited to internal port/service enumeration inferred from returned error messages (VC:L); there is no integrity or availability impact. Limiting factors that reduce real-world risk: the setup/ directory must be accessible (many hardened deployments block or remove it after initial configuration), the high attack complexity and present attack requirements (AC:H/AT:P) mean exploitation is not trivially reliable, and output is restricted to error-message-based inference rather than arbitrary response retrieval.

This is a medium-severity, real-but-not-urgent issue. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 6.3 and confirms a network-reachable, unauthenticated vector (PR:N), but the high attack complexity (AC:H) and present attack requirements (AT:P) plus only low confidentiality impact (VC:L, with VI:N/VA:N/SC:N/SI:N/SA:N) reflect that this is a blind/semi-blind SSRF whose yield is limited to inferring internal port state from returned MySQL-protocol error messages - not data theft, code execution, or write access. No EPSS score and no KEV status are present in the input, so there is no signal of active or probabilistic exploitation to weigh; exploitation status is therefore 'no public working exploit identified at time of analysis' (see confidence notes regarding the public write-up). The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with the medium CVSS and absence of KEV. Net: a genuine SSRF worth patching within the normal monthly cycle, not a high-CVSS-but-low-real-risk false alarm nor a drop-everything emergency. The signals are consistent with each other; the main caveat is that real-world exposure hinges on whether the setup/ endpoint is network-reachable, which is a deployment-dependent condition the CVSS vector does not capture.

An attacker who can reach a phpMyAdmin instance's setup/validate.php endpoint sends a POST request supplying an attacker-chosen host and port; because validate.php lacks the setup-disabled guard, the request reaches Validator::testDBConnection() and opens an outbound MySQL-protocol connection to that target. By varying the host/port and reading the returned connection error messages, the attacker maps reachable internal services and open ports behind the server. A public technical write-up describing the flaw exists, but the input does not confirm working, weaponized exploit code.