CVE-2026-100695
Received Received - Intake

Adminer 6.0.2 XSS Leading to RCE via INTO DUMPFILE

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has FILE privileges and can write to the webroot, attackers can use the XSS to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution as the web server account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100695
EUVD
EUVD-2026-87668

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
adminer adminer to 6.0.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Adminer before version 6.0.2 has a cross-site scripting (XSS) flaw where the CONNECTION_ID() database result is inserted into JavaScript without proper escaping. This allows a malicious database server to run arbitrary JavaScript in the authenticated Adminer session. If the database has FILE privileges and can write to the webroot, attackers can exploit the XSS to submit authenticated SQL queries that write PHP files using INTO DUMPFILE, leading to remote code execution as the web server account.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in your Adminer session, potentially stealing session cookies, performing actions on your behalf, or writing malicious PHP files to the server if the database has sufficient privileges. This could lead to full compromise of the web server and any data it handles.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. It may result in data breaches, unauthorized data exfiltration, or modification, leading to non-compliance with these regulations and potential legal consequences.

Mitigation Strategies

Upgrade Adminer to version 6.0.2 or later to address the cross-site scripting vulnerability. Ensure the database server does not have FILE privileges or access to write to the webroot to prevent potential remote code execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart