EUVD-2026-65195
GHSA-jh7j-hfxx-jv6m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Adminer behind misconfigured proxy
-
DeliverySend HTTP request with /\evil.com X-Forwarded-Prefix
-
ExploitBypass regex guard in bootstrap.inc.php
-
ExecutionBrowser normalizes backslash to slash
-
PersistCorrupted path reaches cookie_path()
-
ImpactSet-Cookie Path attribute malformed in response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires two simultaneous conditions: (1) the reverse proxy in front of Adminer is misconfigured or absent, allowing clients to supply an arbitrary X-Forwarded-Prefix header that is forwarded unmodified to Adminer; (2) user interaction is required (the browser must process the malformed Set-Cookie response). Exploitation is limited to Adminer versions 4.6.0-5.5.0. The impact is bounded to cookie-path scoping anomalies - there is no code execution, authentication bypass, or data exfiltration path identified. Properly configured reverse proxies that strip or validate the X-Forwarded-Prefix header are not exposed. |
| Impact | The CVSS 4.0 score of 2.3 (Very Low) is well-calibrated for this issue: attack complexity is high (AC:H) because exploitation requires a misconfigured or absent reverse proxy - a condition that should not exist in hardened deployments - and user interaction is required (UI:P). The practical impact is limited to anomalous cookie-path scoping (VI:L), with no confidentiality or availability consequences confirmed. EPSS data was not provided in the source intelligence, but the narrow exploitation prerequisites and low integrity impact suggest a very low probability of widespread opportunistic exploitation. There is no KEV listing and no public exploit code identified. This is a case where a theoretically elegant bypass (backslash normalization) translates to negligible real-world risk because it requires both a proxy misconfiguration and a specific browser behavior to chain; even a small, well-configured deployment is effectively unexposed if the reverse proxy strips or validates the X-Forwarded-Prefix header. |
| Exploit ScenarioDerived | An attacker positioned between an end user and a misconfigured reverse proxy - or operating on a network where the proxy does not strip X-Forwarded-Prefix - sends a crafted HTTP request to Adminer with the header value /\evil.com. Adminer's validation guard passes this value, which then propagates through cookie_path() and results in the browser receiving a Set-Cookie response with an anomalous Path attribute that references a network-path. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 25, 2026
Cookie-path scoping manipulation in Adminer 4.6.0-5.5.0 results from an incomplete fix for a prior X-Forwarded-Prefix header injection (GHSA-8478-xrj3-h9c2). The validation guard in bootstrap.inc.php blocks double-slash prefixes (//evil.com) but accepts backslash variants (/\evil.com); because browsers normalize backslash to forward slash, the malformed prefix survives as a network-path reference into cookie_path(), corrupting the Set-Cookie Path attribute. Exploitation depends on a misconfigured or absent reverse proxy that permits clients to supply the X-Forwarded-Prefix header, and no public exploit has been identified at time of analysis.
RemediationAI
Upgrade to Adminer 5.5.1, which contains the corrected validation logic for the X-Forwarded-Prefix header, per the vendor advisory at https://github.com/vrana/adminer/security/advisories/GHSA-fr74-9mf9-gf44. If an immediate upgrade is not possible, the most effective compensating control is to configure the reverse proxy to strip or overwrite the X-Forwarded-Prefix header before it reaches Adminer, ensuring clients cannot inject arbitrary values; this eliminates the attack surface entirely without modifying the application. Alternatively, restrict direct network access to the Adminer endpoint so that only trusted internal clients can reach it, reducing the population of potential header-injecting clients. Neither workaround has known side effects beyond the intended restriction of header forwarding.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adminer is a single-file PHP database management UI (CPE: cpe:2.3:a:vrana:adminer). The bootstrap.inc.php file reads the X-Forwarded-Prefix header to reconstruct a base URL when Adminer runs behind a reverse proxy. The prior fix introduced a regex guard (^/[^/]) that rejects double-slash prefixes (//evil.com), a classic open-redirect vector, but the character class [^/] excludes only the forward slash, not the backslash. The value /\evil.com satisfies the regex (second char is \, not /) yet is treated by browsers as a network-path reference identical to //evil.com after path normalization. The corrupted value then flows into cookie_path(), affecting the Path attribute of Set-Cookie responses. CWE-20 (Improper Input Validation) captures the root cause: insufficient character-set validation that fails to account for browser-side normalization of alternative path separators.
Know when Adminer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Network vector with high complexity (proxy misconfiguration required), no privileges needed, user interaction required; integrity impact limited to cookie-path scoping only.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guard (bootstrap.inc.php) only rejects prefixes matching ^/[^/], blocking //evil.com but allowing values such as /\evil.com whose second character is a backslash. Because browsers normalize backslash to forward slash, a network-path reference survives into REQUEST_URI and reaches cookie_path(), affecting the Set-Cookie Path attribute. Exploitation requires that clients can set the X-Forwarded-Prefix header (a misconfigured or absent reverse proxy). Impact is limited to anomalous cookie-path scoping.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Adminer File Access and Injection Flaws
View all 10Adminer through 4.3.1 has SSRF via the server parameter. Rated critical severity (CVSS 9.8), this vulnerability is remot
Adminer versions 5.4.1 and earlier suffer from a post-message validation bypass that allows remote attackers to trigger
Adminer is an open-source database management in a single PHP file. Rated high severity (CVSS 7.2), this vulnerability i
Adminer is open-source database management software. Rated medium severity (CVSS 6.1), this vulnerability is remotely ex
The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. Rated critical severit
Remote code execution in Adminer before 6.1.1 allows authenticated users with SQLite access to bypass ATTACH and VACUUM
Remote code execution in Adminer 5.4.2 allows authenticated high-privilege users to execute arbitrary code in the contex
Exploit-DB