{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aadmineradminer/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109347"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Adminer (\u003c 6.1.1)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","rce","sqlite"],"_cs_type":"advisory","_cs_vendors":["Adminer"],"content_html":"\u003cp\u003eAdminer versions prior to 6.1.1 contain a critical security vulnerability (CVE-2026-109347) allowing authenticated users with access to SQLite functionality to bypass existing restrictions on ATTACH and VACUUM INTO statements. By prefixing these SQL statements with a UTF-8 byte-order mark (BOM), an attacker can circumvent Adminer's security controls. This allows the attacker to attach a database file to a directory accessible by the web server. Subsequently, the attacker can create a table containing arbitrary PHP code. Because the file is placed within a path served by the web server, requesting the file triggers the web server to execute the injected PHP code, leading to remote code execution under the context of the web server service account. This impacts any environment utilizing Adminer for SQLite management where attackers have acquired authenticated access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in full remote code execution on the server hosting the Adminer interface. Attackers can leverage this to gain persistence, escalate privileges within the server environment, or exfiltrate sensitive data from the underlying database and file system. Organizations managing web-accessible database administration tools are particularly at risk, as the web interface provides a direct conduit for code execution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Adminer to version 6.1.1 or later immediately to patch the restriction bypass vulnerability associated with CVE-2026-109347.\u003c/li\u003e\n\u003cli\u003eRestrict access to the Adminer interface via network-level controls such as IP allowlisting, VPN access, or mutual TLS to prevent unauthorized parties from obtaining the authentication required to initiate the attack.\u003c/li\u003e\n\u003cli\u003eAudit web server logs for unusual SQL patterns or requests to non-standard file paths in directories that store database or application files.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-12T18:37:35Z","date_published":"2026-10-12T18:37:35Z","id":"https://feed.craftedsignal.io/briefs/2026-10-adminer-rce/","summary":"Adminer versions prior to 6.1.1 are vulnerable to remote code execution (RCE) where authenticated SQLite users can bypass security restrictions using UTF-8 byte-order marks to inject and execute PHP code.","title":"Remote Code Execution in Adminer via SQLite Restriction Bypass","url":"https://feed.craftedsignal.io/briefs/2026-10-adminer-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}