CVE-2026-34959
Received Received - Intake

Adminer Path Traversal via X-Forwarded-Prefix Header

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Prefix: https://evil.example) that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This enables an authenticated open redirect after state-changing POSTs, unauthenticated control of the session cookie path attribute, and poisoning of self-referential links; CR/LF cannot be injected, so header splitting/XSS is not possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-34959
EUVD
EUVD-2026-65196

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
vrana adminer 4.6.0
vrana adminer 5.4.0
vrana adminer 5.4.4
vrana adminer to 5.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Adminer versions 4.6.0 to 5.4.4. It involves improper handling of the X-Forwarded-Prefix header, which Adminer blindly prepends to the REQUEST_URI server variable without validation or trusted-proxy checks. Attackers can inject malicious absolute URLs (e.g., https://evil.example) that are then used in redirects, session cookie paths, and self-referential links. This enables open redirects, session path manipulation, and URL poisoning.

Detection Guidance

To detect this vulnerability, check if Adminer versions 4.6.0 through 5.4.4 are running on your system. Inspect HTTP headers for the X-Forwarded-Prefix header being processed without validation. Test with curl commands sending a malicious X-Forwarded-Prefix header to observe if redirects or cookies use attacker-controlled URLs.

Impact Analysis

An attacker could trick users into visiting malicious sites via open redirects after state-changing actions like table edits. They could also control session cookie paths, enabling session fixation on shared hosts. Self-referential links could be poisoned to manipulate user interactions or phish for credentials. CR/LF injection is not possible, so XSS or header splitting attacks are prevented.

Compliance Impact

This vulnerability could lead to unauthorized data exposure or session hijacking, potentially violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Open redirects and session manipulation may enable attackers to access sensitive data or impersonate users, leading to compliance breaches.

Mitigation Strategies

Immediately upgrade Adminer to version 5.5.0 or later. If upgrading is not possible, configure your web server or reverse proxy to only accept X-Forwarded-Prefix from trusted sources. Validate the header to ensure it starts with a forward slash and does not contain '://' or leading '//'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34959. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart