CVE-2026-34967

Name of the Vulnerable Software and Affected Versions Adminer versions 5.3.0 through 5.4.2

Description An arbitrary file write issue exists when the sql-log plugin is enabled. An authenticated user can utilize path traversal sequences—a technique used to access files and directories outside the intended folder—via the ns parameter in the 'plugins/sql-log.php' endpoint to write arbitrary .sql files with controlled content to any writable directory on the host.

Recommendations Update Adminer to a version later than 5.4.2. As a temporary mitigation, disable the sql-log plugin or restrict access to the ns parameter in the 'plugins/sql-log.php' endpoint.