---
id: CVE-2026-56703
title: >-
  Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite
  query handling where VACUUM INTO is not blocked despite ATTACH restrictions
summary: >-
  Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite
  query handling where VACUUM INTO is not blocked despite ATTACH restrictions.
  Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary
  fil…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
published: '2026-08-25'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:23:49.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56703'
references:
  - url: 'https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/adminer-before-remote-code-execution-via-sqlite-vacuum-into
    label: disclosure@vulncheck.com
  - url: 'https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.01171
epssPercentile: 0.66084
ingestedAt: '2026-09-08T21:11:12.285Z'
---

## Overview

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.