CVE-2026-56705
Received Received - Intake

Adminer Remote Code Execution via ODBC Parameter Injection

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-56705
EUVD
EUVD-2026-65203

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
adminer adminer to 5.4.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Adminer before version 5.4.3 fails to sanitize the server field when building a PDO DSN string. This allows unauthenticated attackers to inject ODBC parameters using semicolons. Attackers can add TraceFile and TraceOn parameters to write PHP code to the web root. When the trace file is accessed, the injected code executes, enabling remote code execution.

Detection Guidance

Check Adminer version with: grep -r 'Adminer' /var/www/ or similar paths. Look for Adminer files in web directories. Monitor for unexpected trace files in web roots or ODBC logs. Inspect network traffic for semicolon injections in server parameters.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary code on the server running Adminer. They can gain full control over the system, steal data, install malware, or disrupt services. The impact depends on server configuration and privileges.

Compliance Impact

This vulnerability can lead to data breaches, unauthorized access, and loss of sensitive data. It may violate GDPR (data protection), HIPAA (health information), and other regulations requiring data confidentiality and integrity. Non-compliance could result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Adminer to version 5.4.3 or later immediately. Remove or restrict access to Adminer if not needed. Disable pdo_sqlsrv extension if unused. Ensure web server runs with minimal privileges and restricts write access to web root.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56705. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart