CVE-2026-56705

Name of the Vulnerable Software and Affected Versions Adminer versions prior to 5.4.3

Description Insufficient sanitization of the server field during the construction of a PDO DSN (Data Source Name) string allows unauthenticated attackers to inject ODBC parameters using semicolons. By injecting the TraceFile and TraceOn parameters, an attacker can write PHP code directly into the web root, leading to remote code execution when the resulting trace file is accessed.

Recommendations Update to version 5.4.3 or later.