Adminer CVE-2026-34968

Exploitation requires valid credentials to the Adminer instance, confirmed by the CVSS 4.0 PR:L metric. Additionally, Adminer must be deployed with SQLite mode available and accessible - instances configured exclusively for other database backends (MySQL, PostgreSQL, etc.) cannot reach the vulnerable code path. The targeted file must be writable by the operating system user account under which PHP (and thus the web server) executes; files owned by root or other privileged users are unaffected unless the PHP process runs as root, which is a non-default misconfiguration. No user interaction beyond the attacker's own authenticated session is required (UI:N). Limiting factors include: required prior authentication, explicit SQLite mode availability, and PHP process user filesystem permissions, all of which collectively constrain the realistic attacker population and blast radius beyond what the raw CVSS score alone conveys.

The CVSS 4.0 score of 7.2 with AV:N/AC:L/AT:N/PR:L/UI:N reflects a network-exploitable flaw with low attack complexity that is bounded by the authentication prerequisite (PR:L) and the SQLite-mode deployment condition. The absence of a confidentiality impact (VC:N/SC:N) is notable - this is a destruction primitive, not a data exfiltration vector, which somewhat narrows its appeal to opportunistic attackers but makes it highly relevant to ransomware-adjacent or sabotage scenarios. EPSS data was not included in the provided intelligence, so probabilistic exploitation forecasting cannot be performed. Neither CISA KEV status nor confirmed public exploit code has been identified, meaning active exploitation has not been verified by an authoritative source; however, even a mid-sized municipal IT team in mielec running a shared Adminer instance should treat this as urgent given that path traversal exploitation is mechanically trivial once valid credentials are obtained. The SQLite-mode constraint meaningfully limits the affected population - organizations running Adminer exclusively against MySQL, PostgreSQL, or other non-SQLite backends are unaffected. The VulnCheck and GitHub advisory sources are corroborating but there is no independent third-party verification of the exact scope of affected versions beyond the vendor advisory.

An attacker with valid Adminer credentials selects the SQLite mode and sends a crafted POST request to the database list drop endpoint, injecting a path traversal sequence such as ../../application/config/database.php into the db[] parameter. Adminer, lacking extension validation, passes the resolved path to PHP's file deletion function, silently removing the targeted file. The result is application failure, data loss, or disruption of dependent services - achievable with a single authenticated HTTP request requiring no special tooling.