Adminer Vulnerability CVE-2026-56705: Critical Remote Code Execution Risk
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- adminer (packagist)
- Affected versions
- >= v5.4.2, <= v5.4.2 or >= v5.4.1, <= v5.4.1 or >= v5.4.0, <= v5.4.0 or >= v5.3.0, <= v5.3.0 or >= v5.2.1, <= v5.2.1 or >= v5.2.0, <= v5.2.0 or >= v5.1.1, <= v5.1.1 or >= v5.1.0, <= v5.1.0 or >= v5.0.6, <= v5.0.6 or >= v5.0.5, <= v5.0.5 or >= v5.0.4, <= v5.0.4 or >= v5.0.3, <= v5.0.3 or >= v5.0.2, <= v5.0.2 or >= v5.0.1, <= v5.0.1 or >= v5.0.0, <= v5.0.0 or >= v4.17.1, <= v4.17.1 or >= v4.17.0, <= v4.17.0 or >= v4.16.0, <= v4.16.0 or >= v4.8.1, <= v4.8.1 or >= v4.8.0, <= v4.8.0 or >= v4.7.9, <= v4.7.9 or >= v4.7.8, <= v4.7.8 or >= v4.7.7, <= v4.7.7 or >= v4.7.5, <= v4.7.5 or >= v4.7.4, <= v4.7.4 or >= v4.7.3, <= v4.7.3 or >= v4.7.2, <= v4.7.2 or >= v4.7.1, <= v4.7.1 or >= v4.7.0, <= v4.7.0 or >= v4.6.3, <= v4.6.3 or >= v4.6.2, <= v4.6.2 or >= v4.6.1, <= v4.6.1 or >= v4.6.0, <= v4.6.0 or >= v4.5.0, <= v4.5.0 or >= v4.4.0, <= v4.4.0 or >= v4.3.1, <= v4.3.1 or >= v4.3.0, <= v4.3.0 or >= v4.2.5, <= v4.2.5 or >= v4.2.4, <= v4.2.4 or >= v4.2.3, <= v4.2.3 or >= v4.2.2, <= v4.2.2 or >= v4.2.1, <= v4.2.1 or >= v4.2.0, <= v4.2.0 or >= v4.1.0, <= v4.1.0 or >= v4.0.3, <= v4.0.3 or >= v4.0.2, <= v4.0.2 or >= v4.0.1, <= v4.0.1 or >= v4.0.0, <= v4.0.0 or >= v3.7.1, <= v3.7.1 or >= v3.7.0, <= v3.7.0 or >= v3.6.4, <= v3.6.4 or >= v3.6.3, <= v3.6.3 or >= v3.6.2, <= v3.6.2 or >= v3.6.1, <= v3.6.1 or >= v3.6.0, <= v3.6.0 or >= v3.5.1, <= v3.5.1 or >= v3.5.0, <= v3.5.0 or >= v3.4.0, <= v3.4.0 or >= v3.3.4, <= v3.3.4 or >= v3.3.3, <= v3.3.3 or >= v3.3.2, <= v3.3.2 or >= v3.3.1, <= v3.3.1 or >= v3.3.0, <= v3.3.0 or >= v3.2.2, <= v3.2.2 or >= v3.2.1, <= v3.2.1 or >= v3.2.0, <= v3.2.0 or >= v3.1.0, <= v3.1.0 or >= v3.0.1, <= v3.0.1 or >= v3.0.0, <= v3.0.0
- Patched version
- 5.4.3
Adminer versions before 5.4.3 are under investigation for a critical vulnerability that could allow unauthenticated remote code execution.
What happened
Adminer before version 5.4.3 reportedly fails to sanitize the server field before constructing a PDO DSN string. This vulnerability allows unauthenticated attackers to inject ODBC parameters via semicolons. By injecting TraceFile and TraceOn parameters, attackers can write PHP code to the web root, leading to remote code execution when the trace file is accessed.
The vulnerability has been assigned CVE-2026-56705 with a CVSS score of 9.8, indicating a critical severity level. The issue has not been exploited in the wild as of the latest reports. Users of Adminer are advised to assess their exposure and take immediate action to mitigate the risk.
What to do about it
- Upgrade to Adminer version 5.4.3 or later to mitigate the risk of remote code execution.
- Review your Adminer installations to determine if they fall within the affected version range.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation advice.
- Consider implementing additional security measures to protect against potential attacks while the upgrade is being performed.
How 0Day would have caught this
adminer is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Adminer version 5.4.2 or earlier, you are potentially affected by this vulnerability.
What should I do right now?
Immediately upgrade to Adminer version 5.4.3 or later to protect against the remote code execution risk.
Has this vulnerability been patched?
Yes, Adminer version 5.4.3 includes a patch for this vulnerability.
Where can I find more information about this vulnerability?
Consult the primary sources provided, including the CVE-2026-56705 page on the NVD website.