CVE-2026-109347GHSA-r9r5-j5q8-8c59
Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass
vrana adminerApplications & CMS
CVSS
8.6HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.65%Chance of exploitation activity in the next 30 days, higher than 50% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 6.1.1adminerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.
Text from CVE List
Affected versions 2
- admineraffected: all versions before 6.1.1CVE List
- adminerunaffected: 6.1.1CVE List