CVE-2021-43008 Files or Directories Accessible to External Parties in Adminer

What is CVE-2021-43008?

CVE-2021-43008 is a high-severity path traversal vulnerability in Debian Debian Linux, published on 5 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.

Which versions are affected by CVE-2021-43008?

2 open source packages ship an affected version, including vrana/adminer. It affects 2 products.

Products include Adminer Adminer, Debian Debian Linux.

How do I fix CVE-2021-43008?

Upgrade vrana/adminer to 4.6.3 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-43008 being exploited?

There is no known exploitation of CVE-2021-43008 in the wild and no public exploit code.

Public exploit code: 3 proofs of concept on GitHub.

Other vulnerabilities in Debian Debian Linux

• CVE-2021-21311 Adminer Server-Side Request Forgery Exploited High 7.2
• CVE-2018-7667 vrana/adminer vulnerable to SSRF by connecting to privileged ports Critical 9.8
• CVE-2025-43960 Adminer PHP Object Injection issue leads to Denial of Service High 8.6
• CVE-2026-25892 Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint High 7.5
• CVE-2021-29625 XSS in doc_link High 7.5

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-43008, DLA-3002-1, GHSA-rxfq-3vpc-vv72, UBUNTU-CVE-2021-43008.