AdminNeo: SQLite database-list arbitrary file deletion (CVE-2026-96633)

AdminNeo contains an arbitrary file deletion vulnerability (CVE-2026-96633) within its SQLite driver. The application's drop_databases() function incorrectly trusts the db[] parameter provided in POST requests, passing it directly to the PHP unlink() function without validating that the targeted path corresponds to a legitimate SQLite database file or enforcing extension restrictions. An authenticated attacker can leverage this to delete any file on the filesystem that the web server process has sufficient permissions to remove.

Attack Chain

1. Attacker authenticates to the AdminNeo web interface.
2. Attacker retrieves a valid CSRF token from the application session.
3. Attacker identifies a target file on the server filesystem that is writable by the web server process.
4. Attacker initiates a database drop request via the AdminNeo UI or a crafted POST request.
5. Attacker injects the arbitrary file path into the db[] parameter of the POST request.
6. The drop_databases() function receives the malicious path and proceeds to call unlink() on the file.
7. The target file is successfully deleted from the server.

Impact

Successful exploitation allows for the deletion of arbitrary files accessible to the PHP process. This can lead to denial-of-service by deleting critical configuration or system files, or potentially disrupt other applications hosted on the same server.

Recommendation

• Upgrade the AdminNeo package to version 5.5.1 or later immediately.
• Implement access control checks to ensure users can only drop databases that are explicitly listed as authorized for their session.
• Apply strict path validation and canonicalization to the db[] input parameter to prevent directory traversal and deletion of non-database files.
• Ensure the database deletion logic enforces file extension verification (e.g., .db, .sdb, .sqlite) equivalent to the validation logic used in database creation operations.