CVE-2026-109347

CVSS 8.6 (high) · published 2026-10-12

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.

Weakness: CWE-94

Source: NVD CVE-2026-109347

References

• https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59
• https://www.vulncheck.com/advisories/adminer-before-6.1.1-rce-via-utf-8-bom-sqlite-attach-bypass
• https://github.com/vrana/adminer/security/advisories/GHSA-r9r5-j5q8-8c59

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.