CVE-2026-56705
CriticalCVSS 9.8Summary
Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution.
Risk Assessment
This can lead to full compromise of the web server, as attackers can execute arbitrary PHP code.
Recommendation
Update Adminer to version 5.4.3 or later. Ensure the server field is properly sanitized.
Original NVD description (English source)
Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.