AdminNeo CVE-2026-96630

Requires an authenticated AdminNeo session using the SQLite driver with the ability to execute arbitrary SQL (the SQL command console), against AdminNeo versions before 5.5.1. The target SQLite build must support VACUUM INTO (SQLite 3.27.0+). Successful web-shell deployment additionally requires that the PHP/web-server process has write permission to a directory that is both web-served and configured to execute PHP, and that the attacker knows (or can reach) that path. Limiting factors: valid database credentials are mandatory (PR:H), the write target must be a writable+PHP-executing web directory (non-default/hardened deployments may block this), and upgrading to 5.5.1 is the vendor's fix.

This is a genuine high-priority issue for anyone exposing AdminNeo's SQLite driver, but it is not an unauthenticated internet-wide emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) and the root-cause commit agree on the mechanism: the SQLite query blocklist in sql.inc.php stopped only ATTACH, so VACUUM INTO (SQLite ≥ 3.27.0) could write the database file - including attacker-chosen bytes placed in a table name - to any path, yielding a PHP web shell and command execution (root in the reporter's PoC). PR:H/AC:L is consistent with the described trigger: a logged-in SQLite user runs two straightforward SQL statements, no race or timing condition. The vuln.today decision label is 'this_week' (not act_now/emergency), which fits the signal mix. No EPSS score is provided, so widespread-exploitation probability cannot be quantified from this data. The CVE is not in CISA KEV and there is no indication of active exploitation; exploitation status is therefore 'no public exploit identified' with the caveat that the advisory itself publishes complete, working reproduction steps (see exploit note). The practical risk is gated by the PR:H authentication requirement and by whether the PHP process can write to a web-served, PHP-executing directory - both real limiters that keep this below the tier of a remote pre-auth RCE despite the High C/I/A impacts.

An attacker who already has valid credentials to AdminNeo's SQLite interface opens the SQL command console, creates a table whose name embeds PHP (e.g. CREATE TABLE "<?php system($_GET['c']); ?>" (i int);), then runs VACUUM INTO '/var/www/html/shell.php' to write the raw database bytes - including that PHP - into the web root. They then request the planted file (curl http://TARGET/shell.php?c=id) to run OS commands as the web server user. The GHSA advisory publishes these exact steps as a working proof of concept, though no packaged exploit tool is referenced.