EUVD-2026-116068Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious .shp file
-
DeliverySubmit for import to app using the library
-
ExploitShapeRecord::loadFromFile parses crafted record
-
ExecutionParser enters infinite loop (CWE-835)
-
ImpactProcess hangs, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target application to load or import an attacker-supplied ESRI .shp shapefile through the ShapeRecord::loadFromFile parsing path in phpMyAdmin ShapeFile (versions up to 4.0.1); the UI:P metric means the crafted file must actually be passed to the parser for the condition to fire. No authentication is required (PR:N) and the attack is network-reachable (AV:N) wherever the import is exposed. Limiting factors: the SHP import/parse feature must be in use, impact is confined to availability (a parsing hang / CPU consumption, VA:L) with no confidentiality or integrity effect, and the trigger depends on the application accepting externally supplied shapefiles. |
| Impact | The CVSS 4.0 base score is 5.3 (Medium), driven entirely by a low availability impact (VA:L) with no confidentiality or integrity effect (VC:N/VI:N) - this is a pure denial-of-service via infinite loop (CWE-835), not a code-execution or data-exposure flaw. The vector is AV:N/AC:L/PR:N but notably UI:P, meaning a user or application must passively load the attacker-supplied shapefile for the loop to trigger. Exploit maturity is E:P (proof-of-concept), consistent with the input, which lists a PoC reference that is not verified as working exploit code; there is a public PoC reference, but it is not verified as working exploit code. This CVE is NOT in CISA KEV (no active-exploitation signal), and no EPSS score was provided, so widespread exploitation probability cannot be quantified from the available data. The vuln.today decision label is 'this_month,' indicating a routine-but-tracked priority rather than an emergency. Net assessment: a real but moderate issue - a bounded availability hit requiring a crafted file to be parsed, against an unpatched library whose vendor did not respond to disclosure. Treat as a schedule-driven DoS risk, not a drop-everything event. |
| Exploit ScenarioDerived | An attacker crafts a malformed ESRI .shp file and gets it submitted to an application that uses the phpMyAdmin ShapeFile library to import geospatial data; when the import path calls ShapeRecord::loadFromFile, a malformed record count or offset causes the parser to enter an infinite loop, hanging the worker and denying service. A public PoC reference exists but is not verified as working exploit code; the CVSS vector's UI:P means the attack succeeds only once the target actually loads the crafted shapefile. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
An infinite loop in the ShapeRecord::loadFromFile parser of phpMyAdmin ShapeFile (versions up to and including 4.0.1) allows remote attackers to stall or hang the importing process by supplying a crafted ESRI .shp file, consuming CPU until the process is killed or times out. No authentication is required, but the crafted shapefile must actually be fed into the SHP import/parse path for the condition to fire, so exposure is limited to deployments that accept externally supplied shapefiles. Impact is confined to availability (VA:L) with no confidentiality or integrity effect; a public PoC reference exists, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
RemediationAI
No vendor-released patch has been identified at time of analysis: the vendor was contacted about the disclosure and did not respond, and no fixed version is published, so upgrading alone is not currently an option and VulDB's entry at https://vuldb.com/vuln/430227 should be monitored for an update. Until a fix ships, the effective control is to deny untrusted input to the parser: disable or restrict access to the SHP import/parse functionality (and the endpoint that calls ShapeRecord::loadFromFile) to trusted administrative users or internal networks only, at the cost of losing geodata import for ordinary users. Where imports must stay enabled, require shapefiles to be pre-validated and re-exported through a trusted GIS tool before upload, and run the parsing step in a worker process with a hard wall-clock and CPU time limit plus automatic restart so a non-terminating loop is killed rather than pinning the service - accepting that legitimate very large imports may be terminated and that user-visible imports will fail mid-run. Processing untrusted shapefiles in an isolated, resource-capped container limits collateral impact to the host. Remediation is scheduled within this month per the current priority decision rather than as an emergency response, given the availability-only impact and the unverified nature of the public PoC reference.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-835 (Loop with Unreachable Exit Condition, i.e. an infinite loop) and lives in the ShapeRecord::loadFromFile method of phpMyAdmin's ShapeFile library, the component that reads ESRI .shp geometry files (typically accompanied by .shx/.dbf siblings) during geodata import. Parsing binary record structures from an untrusted file means the loop condition and record-advance logic are driven entirely by attacker-influenced bytes; when those bytes do not satisfy the parser's exit condition, the read never terminates. The precise byte pattern or field that triggers the non-terminating loop is not described in the available sources beyond the loadFromFile parsing path. Because the failure occurs inside the parsing routine rather than in memory handling, the consequence is resource exhaustion (a hung worker thread or request) rather than memory corruption or code execution. The affected CPE is cpe:2.3:a:phpmyadmin:shapefile:*:*:*:*:*:*:*:*, i.e. the standalone ShapeFile library spanning releases through 4.0.1; both the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) agree the attacker needs no privileges and that the only impact is reduced availability.
Know when Phpmyadmin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable parsing (AV:N) with no auth (PR:N) but a user must load the crafted shapefile (UI:R); only an availability hang results, so C:N/I:N/A:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Phpmyadmin
View allphpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to
phpMyAdmin 3.5.2.2, as distributed by the cdnetworks-kr-1 mirror during an unspecified time frame in 2012, contains an e
phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a
An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute
SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.2.0 via t
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. Rated critical severity (CV
libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allo
phpMyAdmin through 5.0.2 allows CSV injection via Export Section. Rated high severity (CVSS 8.8), this vulnerability is
In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. Rated high severity (CV
phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_ope
libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.7, 4.1.x before 4.1.14.8, and 4.2.x before 4.2.13.1 allows re
The Portable phpMyAdmin plugin before 1.3.1 for WordPress allows remote attackers to bypass authentication and obtain ph
Exploit-DB