CVE-2026-109347— Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass
Quick assessment
Affected
vrana adminer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Adminer 在 6.1.1 版本之前存在远程代码执行漏洞。该漏洞允许经过身份验证的 SQLite 用户通过在语句前添加 UTF-8 字节顺序标记（BOM），绕过 ATTACH 和 VACUUM INTO 的限制。攻击者可以将数据库文件附加到由 PHP 提供服务的文件路径中，并创建一个以 PHP 代码命名的表，从而以 Web 服务器用户的身份执行该代码。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109347
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH Bypass
Source: CVE Program / CVE List V5
Vulnerability Description
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109347
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109347
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109347 (2)
IV. Related Vulnerabilities
Same product: adminer
-
CVE-2026-100698
Adminer before 6.0.2 Privileged-Port SSRF via host_port Rege -
CVE-2026-100696
Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch -
CVE-2026-100697
Adminer 6.0.0 Server-Side Request Forgery via ClickHouse dri -
CVE-2026-100695
Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE -
CVE-2026-56706
Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Mask
Same vendor: vrana
-
CVE-2026-100698
Adminer before 6.0.2 Privileged-Port SSRF via host_port Rege -
CVE-2026-100696
Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch -
CVE-2026-100697
Adminer 6.0.0 Server-Side Request Forgery via ClickHouse dri -
CVE-2026-100695
Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE -
CVE-2026-56706
Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Mask
Same weakness: CWE-94
-
CVE-2026-86803
Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode E -
CVE-2026-54566
Markdown Preview Enhanced: Remote Code Execution via VM Sand -
CVE-2026-85714
Stirling-PDF: Remote Code Execution via H2 -
CVE-2026-103081
WordPress Salevo plugin <= 1.3.0 - Content Injection vulnera -
CVE-2026-108151
WordPress MDTF plugin <= 1.3.9 - Arbitrary Code Execution vu
V. Comments for CVE-2026-109347
No comments yet