---
id: CVE-2026-56705
title: >-
  Adminer before 5.4.3 fails to sanitize the server field before constructing a
  PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters
  via semicolons
summary: >-
  Adminer before 5.4.3 fails to sanitize the server field before constructing a
  PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters
  via semicolons. Attackers can inject TraceFile and TraceOn parameters to write
  PHP…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-73
published: '2026-08-25'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:23:49.880'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56705'
references:
  - url: 'https://github.com/vrana/adminer/security/advisories/GHSA-r4x9-5m63-3vxw'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/adminer-before-remote-code-execution-via-mssql-pdo-dsn-injection
    label: disclosure@vulncheck.com
  - url: 'https://github.com/vrana/adminer/security/advisories/GHSA-r4x9-5m63-3vxw'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - exploit-available
epss: 0.00497
epssPercentile: 0.41719
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/Boreas37/CVE-2026-56705'
    - 'https://github.com/ChiefYoru/Exploit-CVE-2026-56705'
  checkedAt: '2026-09-24T07:53:08.725Z'
exploitAvailable: true
ingestedAt: '2026-09-08T21:11:12.285Z'
---

## Overview

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.