- The Mess: A critical vulnerability in Adminer, tracked as CVE-2026-56705, can let an unauthenticated attacker achieve remote code execution through the application’s database server connection handling. The flaw affects Adminer versions before 5.4.3 and carries a CVSS 9.3 under CVSS v4.0 from the CNA; other security databases score the issue as critical under CVSS v3.1.
The vulnerable code fails to properly sanitize the attacker-controlled server field before using it to construct a PDO connection string.
That is where things go sideways.
When Adminer connects through the vulnerable MSSQL/ODBC path, an attacker can inject additional connection parameters using semicolons.
Parameters such as TraceFile.
And TraceOn.
Those options can tell the underlying ODBC stack to write connection trace data to a file.
Pick a location inside the web root.
Inject attacker-controlled content.
Then access the generated file.
Congratulations. The database management interface has helped write your payload to the web server.
No stolen password.
No Adminer account.
No victim clicking anything.
The attack starts at the login page.
That alone makes this a very different story from the earlier Adminer bugs we rejected today.
Adminer also received several other security fixes in the same 5.4.3 release. Another freshly published flaw, CVE-2026-56702, allows an authenticated user to abuse the AdminerFileUpload plugin to upload PHP files and potentially execute code when the upload path is web-accessible.
So if you’re running an old adminer.php somewhere on a server because “it’s only used occasionally,” today would be a good day to go looking for it.
- The Damage: An unauthenticated attacker could potentially turn a publicly exposed Adminer installation into a remote-code-execution foothold, allowing them to run code as the web server user and start digging through everything that account can reach.
And Adminer rarely lives in an interestingly empty environment.
It manages databases.
Which means database credentials are already part of the picture.
A compromised Adminer instance can potentially become the first step toward stealing application data, modifying databases, planting persistence or attacking other services reachable from the server.
The actual impact depends heavily on how Adminer is deployed and which database drivers are enabled. The vulnerable RCE path specifically involves the affected MSSQL/ODBC handling.
But if your Adminer login page is exposed to the internet, “we don’t actively use MSSQL” is not the kind of assumption you want to make without checking the actual PHP environment.
And there is a bigger lesson here.
Single-file admin tools have a habit of surviving for years.
Someone uploads adminer.php.
Uses it once.
Forgets it.
The server remembers.
- The Fix: Upgrade Adminer to 5.4.3 or later immediately. If you cannot patch at once, remove public access to Adminer, place it behind a VPN or IP allowlist, and disable the affected MSSQL/
pdo_sqlsrvfunctionality if it is not needed.
Also search your servers.
Seriously.
Look for:
adminer.php
Old copies.
Backup directories.
Random deployment folders.
That forgotten copy on a subdomain nobody has visited since 2023 is exactly the sort of thing attackers love finding before administrators do.
Bugstoday Opinion
Earlier today, Adminer almost made it onto Bugstoday for the wrong reason.
We stopped and checked.
Good thing.
The real story is much better.
An unauthenticated RCE hiding behind a database management login page is not something you ignore because the tool is “just a PHP file.”
Sometimes one PHP file is enough.
Especially when that file manages databases.
Bugstoday verdict: find your Adminer installations, update to 5.4.3, and delete the copies nobody remembers installing. Forgotten admin tools have a nasty habit of becoming remembered during incident response.
