CVE-2026-56702
Received Received - Intake

Adminer Unrestricted File Upload to RCE

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-56702
EUVD
EUVD-2026-65200

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vrana adminer to 5.4.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Adminer versions before 5.4.3 have an unrestricted file upload vulnerability in the AdminerFileUpload plugin. Authenticated users can upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.

Detection Guidance

Check Adminer versions before 5.4.3 using commands like 'adminer --version' or inspect the AdminerFileUpload plugin configuration. Look for web-accessible upload directories and verify if PHP files can be uploaded to columns ending in _path.

Impact Analysis

This vulnerability allows attackers to upload malicious PHP files and execute arbitrary code on the server as the web-server user. It can lead to remote code execution, privilege escalation, exposure of sensitive data, and potential lateral movement within the system.

Compliance Impact

This vulnerability can lead to unauthorized access, data breaches, and exposure of sensitive information, which may violate compliance requirements under GDPR, HIPAA, and other regulations. Organizations could face legal penalties, reputational damage, and loss of trust due to non-compliance resulting from this security flaw.

Mitigation Strategies

Upgrade Adminer to version 5.4.3 or later. Restrict the file upload allowlist to safe extensions like images only. Disable web-serving of upload directories or ensure PHP execution is blocked in those directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart