CVE-2026-100695 Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
A malicious database server can trigger XSS in Adminer, potentially leading to remote code execution if the database has file write privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-100695?
CVE-2026-100695 is a medium-severity cross-site scripting vulnerability in vrana adminer, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTION_ID() database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database has FILE privileges and can write to the webroot, attackers can use the XSS to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution as the web server account.
Weakness: CWE-79
Which versions are affected by CVE-2026-100695?
How do I fix CVE-2026-100695?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-100695 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100695 exists.
Sources
Also known as DEBIAN-CVE-2026-100695, GHSA-3hv2-gxcf-jxpg, GHSA-7c5h-q78c-fpxx, UBUNTU-CVE-2026-100695.