{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56703 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2026-56703 is a high-severity code injection vulnerability in vrana adminer, published on 25 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-56703 and fix it if it is affected.\n\nWhat it is: CVE-2026-56703 is a high-severity code injection vulnerability in vrana adminer, published on 25 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56703 exists.\n\nAffected product: vrana adminer. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-56703/ (Markdown: https://insights.sbomify.com/CVE-2026-56703/index.md)","id":"CVE-2026-56703","markdown":"https://insights.sbomify.com/CVE-2026-56703/index.md","name":"CVE-2026-56703","record":{"aliases":["DEBIAN-CVE-2026-56703","GHSA-gmx3-g29w-77wf","GHSA-j4fh-9p52-f987","UBUNTU-CVE-2026-56703"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Database management tool","requires_auth":"high_privilege","summary":"Authenticated attackers can exploit SQLite VACUUM INTO to write PHP code to arbitrary paths, achieving remote code execution on the server.","user_interaction":"not_required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":8.6,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"description":"Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO","id":"CVE-2026-56703","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"code_injection","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String","id":"CVE-2026-56704"},"packages":[],"prev":{"headline":"Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload","id":"CVE-2026-56702"},"products":["adminer"],"published":"2026-08-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-25","vendors":["vrana"]},"summary":"Authenticated attackers can exploit SQLite VACUUM INTO to write PHP code to arbitrary paths, achieving remote code execution on the server.","url":"https://insights.sbomify.com/CVE-2026-56703/"}