Remote Code Execution in Adminer via SQLite Restriction Bypass

Adminer versions prior to 6.1.1 contain a critical security vulnerability (CVE-2026-109347) allowing authenticated users with access to SQLite functionality to bypass existing restrictions on ATTACH and VACUUM INTO statements. By prefixing these SQL statements with a UTF-8 byte-order mark (BOM), an attacker can circumvent Adminer's security controls. This allows the attacker to attach a database file to a directory accessible by the web server. Subsequently, the attacker can create a table containing arbitrary PHP code. Because the file is placed within a path served by the web server, requesting the file triggers the web server to execute the injected PHP code, leading to remote code execution under the context of the web server service account. This impacts any environment utilizing Adminer for SQLite management where attackers have acquired authenticated access.

Impact

Successful exploitation of this vulnerability results in full remote code execution on the server hosting the Adminer interface. Attackers can leverage this to gain persistence, escalate privileges within the server environment, or exfiltrate sensitive data from the underlying database and file system. Organizations managing web-accessible database administration tools are particularly at risk, as the web interface provides a direct conduit for code execution.

Recommendation

1. Upgrade Adminer to version 6.1.1 or later immediately to patch the restriction bypass vulnerability associated with CVE-2026-109347.
2. Restrict access to the Adminer interface via network-level controls such as IP allowlisting, VPN access, or mutual TLS to prevent unauthorized parties from obtaining the authentication required to initiate the attack.
3. Audit web server logs for unusual SQL patterns or requests to non-standard file paths in directories that store database or application files.