A critical unauthenticated remote code execution flaw in Adminer before 5.4.3 lets attackers inject ODBC parameters into a PDO DSN string and write PHP code into the web root.
What Is It
Adminer, the single-file PHP database management tool, fails to sanitize the server field before using it to construct a PDO DSN string. Because the field is not escaped, an attacker can terminate the intended DSN parameter with a semicolon and append arbitrary ODBC parameters of their choosing.
The published exploitation path abuses the TraceFile and TraceOn parameters: TraceFile points the ODBC driver's trace output at a path inside the web root, and the attacker-controlled content written there is PHP code. Requesting that trace file over the web then executes the injected code. The flaw is classified as CWE-73 (External Control of File Name or Path).
Why It Matters
The issue carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, and no user interaction, with high impact to confidentiality, integrity, and availability. A secondary CVSS 4.0 base score of 9.3 (CRITICAL) is also assigned.
Critically, this is a pre-authentication flaw. An attacker does not need valid database credentials or an Adminer session; reaching the login form is enough to attempt DSN injection. Adminer is frequently deployed as a lone adminer.php dropped into a public web root and left there, which puts the vulnerable code path directly on the internet.
What's Vulnerable
- Vendor/product: vrana / Adminer
- Affected: all versions before 5.4.3
- Fixed: 5.4.3 and later (marked unaffected)
No CPE entries are published in the NVD record at this time.
Patch Status
Upgrade to Adminer 5.4.3, which is the first unaffected release. CVE-2026-56705 does not appear in CISA's Known Exploited Vulnerabilities catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) as of 2026-08-25, so no confirmed active exploitation and no federally mandated remediation deadline currently applies. The CVE was published 2026-08-25 and remains in Received status at NVD, meaning analysis is not yet complete. Given the pre-auth RCE profile and the low bar for exploitation, treat internet-exposed Adminer instances as urgent regardless of KEV status.
Sources
- NVD, CVE-2026-56705: https://nvd.nist.gov/vuln/detail/CVE-2026-56705
- GitHub Security Advisory (vrana/adminer), GHSA-r4x9-5m63-3vxw: https://github.com/vrana/adminer/security/advisories/GHSA-r4x9-5m63-3vxw
- VulnCheck Advisory; Adminer RCE via MSSQL PDO DSN Injection: https://www.vulncheck.com/advisories/adminer-before-remote-code-execution-via-mssql-pdo-dsn-injection
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog