Adminer SQLite RCE via VACUUM INTO Command Execution

Executive Summary

CVE-2026-56703 is a high-severity Remote Code Execution (RCE) vulnerability in Adminer versions 5.4.2 and earlier. It occurs because Adminer blocks ATTACH queries to prevent file creation but fails to block VACUUM INTO, which can write PHP code to arbitrary file paths. Authenticated attackers can exploit this to upload a malicious PHP web shell and execute commands on the server.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if Adminer version 5.4.2 or earlier is installed and if the SQLite driver is enabled. Inspect server logs for unusual VACUUM INTO commands or PHP file writes in the web root. Look for unauthorized PHP files or unexpected database queries.

Useful 0 Not Useful 0

Impact Analysis

If you use Adminer versions before 5.4.3, an attacker with valid credentials could exploit this to gain full control over your server. They could read, modify, or delete sensitive data, install malware, or use your server for further attacks. The impact includes compromised confidentiality, integrity, and availability of your systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face fines, legal penalties, and reputational damage due to unauthorized access to personal or health data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Adminer to version 5.4.3 or later. Disable the SQLite driver in Adminer if not required. Review and remove any unauthorized PHP files in the web root. Monitor for suspicious activity and restrict database user permissions.

Useful 0 Not Useful 0