CVE-2026-56702 Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload
Authenticated attackers can upload PHP webshells via the AdminerFileUpload plugin to execute arbitrary code on the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56702?
CVE-2026-56702 is a high-severity vulnerability in vrana adminer, published on 25 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.
Weakness: CWE-434
Which versions are affected by CVE-2026-56702?
How do I fix CVE-2026-56702?
Upgrade to a fixed version.
Is CVE-2026-56702 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56702 exists.
Sources
Also known as DEBIAN-CVE-2026-56702, GHSA-p84v-vg3f-p9m6, GHSA-vcvj-rwwm-x6g5, UBUNTU-CVE-2026-56702.