Adminer multi_query Remote Code Execution Vulnerability

Executive Summary

CVE-2026-15686 is a high-severity remote code execution vulnerability in Adminer versions 5.4.2 and earlier. It stems from an incorrect check of a function return value in the multi_query function. Attackers exploit catastrophic backtracking in a regex filter meant to block malicious SQL ATTACH statements. By uploading a file with many SQLite comments followed by an ATTACH statement, the regex engine hits PHP's backtracking limit, causing preg_match() to return false. The code only checks for truthy values (1), treating false the same as 0, thus bypassing the filter and allowing malicious SQL execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Adminer installation is version 5.4.2 or earlier. You can verify the version by inspecting the Adminer file or checking the web interface. No specific commands are provided in the resources, but monitoring for unauthorized PHP file creation or unusual SQL queries may help.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers with authentication to execute arbitrary code on your server running vulnerable Adminer versions. An attacker could create and upload a malicious PHP file via SQL injection, then access it via HTTP to execute code in the context of the web server. This could lead to full system compromise, data theft, or further network infiltration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows remote attackers with authentication to execute arbitrary code on affected Adminer installations. Such unauthorized code execution could lead to unauthorized access, data exfiltration, or manipulation of sensitive data, which would violate compliance requirements under GDPR and HIPAA. Organizations using vulnerable versions of Adminer may face regulatory penalties due to potential data breaches or loss of data integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Adminer to version 5.4.3 or later to patch the vulnerability. If updating is not possible, restrict access to Adminer via network controls or disable the multi_query functionality if unused.

Useful 0 Not Useful 0