AdminNeo CVE-2026-59978

No authentication, credentials, or user interaction are required: any network client can POST version[]=... to the ?script=version endpoint of an AdminNeo instance (4.6.2 up to but not including 5.5.0) in its default configuration. Two concrete prerequisites limit exploitation: (1) the web server must be able to write the shared cache file adminneo.version in the temp directory (typically PHP's upload_tmp_dir) - making that file unwritable is the vendor's documented interim workaround; and (2) the crash-triggering read path in design.inc.php runs only when version verification is enabled (isVersionVerificationEnabled). Impact is limited to availability (HTTP 500 DoS) and is self-limiting to the cache's 24-hour lifetime, with immediate recovery by deleting the poisoned cache file.

Signals are internally consistent and point to a genuine but availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) matches the described mechanism exactly: a remote, unauthenticated attacker sends one low-complexity POST with no user interaction, and impact is confined to availability (A:H) with no confidentiality or integrity loss - appropriate for a persistent DoS. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a high-severity DoS that is trivial to trigger yet non-destructive and easily recovered (delete the poisoned cache file, or apply the interim workaround of making adminneo.version unwritable). No EPSS score and no CISA KEV entry are present in the input, so there is no evidence of active exploitation; this is therefore a prioritize-this-week issue rather than an emergency. The GHSA advisory supplies complete step-by-step curl reproduction commands (a public PoC reference), so triggering it is demonstrably easy, but the input does not flag that reference as verified working exploit code and it is not weaponized beyond DoS. Net: a real, easy-to-exploit availability flaw whose practical urgency is tempered by DoS-only impact, fast recovery, a documented workaround, and the likely niche deployment of AdminNeo.

A remote, unauthenticated attacker sends a single HTTP POST to ?script=version with a version[] array parameter, which PHP stores as an array in the shared adminneo.version cache. On the next page load, AdminNeo passes that array to rawurlencode() via cookie(), raising an uncaught TypeError and returning HTTP 500 to every user for the cache's 24-hour lifetime. The GHSA advisory includes full curl reproduction steps, so the attack is trivial to reproduce (AV:N/AC:L, no auth, no user interaction).