Adminer: Remote code execution via UTF-8 BOM bypass of SQLite restrictions
Summary
Adminer before 6.1.1 contains a remote code execution flaw in its SQLite driver. An authenticated user can bypass the ATTACH and VACUUM INTO restrictions by prefixing SQL statements with a UTF-8 byte-order mark, then create a database file in a PHP-served directory and execute PHP code through a table name. Successful exploitation runs code as the web server user and requires a valid Adminer login and a writable PHP-served path.
Affected
- Adminer before 6.1.1 (CVE record: 0 to before 6.1.1; GitHub advisory: 6.1.0 and earlier)
- Versions 5.x and 6.0.x: conflicting sources, treat as affected until clarified
Fixed in
- Adminer 6.1.1 or later (fix commit c33724d35ac9093d2515674832caafa5ab94e9fc)
Workaround
- Unknown. No vendor workaround published.
- Interim measures from the research notes (not vendor guidance): disable the SQLite driver if it is not needed, and restrict access to Adminer to VPN or management IP addresses.
Exploitation
- Public proof of concept in the GitHub advisory; CISA SSVC lists exploitation as poc and automatable as no.
- No in-the-wild exploitation found.
- CISA KEV: not listed according to a third-party tracker; not checked directly.
Our recommendation
- Update Adminer to version 6.1.1 or later, or remove it from the server.
- Do not expose Adminer to the internet; limit access to VPN or management networks.
- Disable the SQLite driver if it is not used.
- Ensure the web server user cannot write into PHP-served directories.
- Review Adminer logins and remove shared or weak accounts.
- Check for unknown PHP files in web directories and monitor for new database files there.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-r9r5-j5q8-8c59 github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-109347 osv.dev
- Ubuntu security notice CVE-2026-109347 ubuntu.com
- NVD data via Vulners vulners.com
- Adminer 6.2.0 release page github.com
- Nixpkgs tracker issue 573673 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:41.
Original description (NVD)
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.