CVE-2026-56703 Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO
Authenticated attackers can exploit SQLite VACUUM INTO to write PHP code to arbitrary paths, achieving remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56703?
CVE-2026-56703 is a high-severity code injection vulnerability in vrana adminer, published on 25 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.
Weakness: CWE-94
Which versions are affected by CVE-2026-56703?
How do I fix CVE-2026-56703?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-56703 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56703 exists.
Sources
Also known as DEBIAN-CVE-2026-56703, GHSA-gmx3-g29w-77wf, GHSA-j4fh-9p52-f987, UBUNTU-CVE-2026-56703.