CVE-2026-109347

Name of the Vulnerable Software and Affected Versions Adminer versions prior to 6.1.1

Description Authenticated SQLite users can achieve remote code execution by bypassing restrictions on the ATTACH and VACUUM INTO statements. This is accomplished by prefixing statements with a UTF-8 byte-order mark, allowing an attacker to attach a database file at a PHP-served path and create a table named with PHP code, which is then executed as the web server user.

Recommendations Update to version 6.1.1 or later.