CVE-2026-25892 Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
An unauthenticated attacker can cause a persistent denial of service in Adminer by injecting an array into the version check endpoint, crashing the application for all users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25892?
CVE-2026-25892 is a high-severity denial of service vulnerability in vrana adminer, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.
Weakness: CWE-20
Which versions are affected by CVE-2026-25892?
2 open source packages ship an affected version, including vrana/adminer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
vrana/adminer Packagist | From 4.6.2 | 5.4.2 |
vrana/adminer Packagist | From 4.6.2 | 5.4.2 |
Products include Adminer Adminer.
How do I fix CVE-2026-25892?
Upgrade vrana/adminer to 5.4.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-25892 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25892 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in vrana adminer
- CVE-2021-21311 Adminer Server-Side Request Forgery
- CVE-2018-7667 vrana/adminer vulnerable to SSRF by connecting to privileged ports
- CVE-2025-43960 Adminer PHP Object Injection issue leads to Denial of Service
- CVE-2021-43008 Files or Directories Accessible to External Parties in Adminer
- CVE-2021-29625 XSS in doc_link
Sources
Also known as GHSA-q4f2-39gr-45jh, UBUNTU-CVE-2026-25892.