CVE-2026-100695: Adminer XSS Vulnerability

CVE-2026-100695 Overview

CVE-2026-100695 is a cross-site scripting vulnerability [CWE-79] in Adminer versions prior to 6.0.2. The flaw occurs when Adminer interpolates the CONNECTION_ID() database result into JavaScript without proper escaping. A malicious database server can return a crafted value that executes arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments where the database holds FILE privileges and can write to the webroot, attackers can escalate the XSS to remote code execution by issuing authenticated SQL requests that write PHP files via INTO DUMPFILE.

Critical Impact
Attackers controlling a connected database server can execute JavaScript in the Adminer session and pivot to remote code execution as the web server account in vulnerable co-located deployments.

Affected Products

Adminer versions prior to 6.0.2
Co-located Adminer deployments where the database has FILE privileges
PHP-based web stacks hosting Adminer in the webroot

Discovery Timeline

2026-09-26 - CVE-2026-100695 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-100695

Vulnerability Analysis

Adminer calls the MySQL/MariaDB CONNECTION_ID() function and injects the returned value directly into client-side JavaScript. The value is not escaped before interpolation, so a database server returning attacker-controlled content can break out of the JavaScript string context and execute arbitrary script in the Adminer origin.

Because the executed script runs under the authenticated Adminer session, it can issue arbitrary SQL requests back through Adminer. Where the connected database account has the FILE privilege and the web server webroot is writable from the database host, the attacker can chain SELECT ... INTO DUMPFILE to drop a PHP webshell. Requesting the dropped file then yields remote code execution as the web server user.

Root Cause

The root cause is improper output encoding of a database-controlled value when embedding it into JavaScript. Adminer trusts the CONNECTION_ID() return value as a numeric identifier and omits context-appropriate escaping. Any string returned by a hostile server reaches the DOM as live script.

Attack Vector

Exploitation requires a victim with an authenticated Adminer session to connect to an attacker-controlled database server, which satisfies the user-interaction requirement in the CVSS vector. Once connected, the malicious server returns a crafted CONNECTION_ID() response that triggers script execution in Adminer. The script then uses the active session to perform SQL operations that write PHP files to the webroot via INTO DUMPFILE, converting client-side script execution into server-side code execution.

See the GitHub Security Advisory and the VulnCheck XSS Advisory for technical details.

Detection Methods for CVE-2026-100695

Indicators of Compromise

Unexpected PHP files appearing in the Adminer webroot or adjacent writable directories.
Database query logs showing SELECT ... INTO DUMPFILE or INTO OUTFILE statements issued from Adminer sessions.
Outbound Adminer connections to unknown or external database hosts not previously approved.
Web server processes spawning shells or interpreters after requests to newly created .php files.

Detection Strategies

Monitor web server directories for new PHP files created during or shortly after Adminer activity.
Alert on database audit events that record FILE privilege use, especially INTO DUMPFILE and INTO OUTFILE operations.
Inspect HTTP access logs for requests to Adminer followed by requests to newly introduced PHP endpoints.
Flag Adminer login flows that target database hosts outside an allowlist of internal servers.

Monitoring Recommendations

Enable MySQL/MariaDB general query logging on servers that service Adminer and review for suspicious write operations.
Correlate webroot file integrity monitoring with Adminer HTTP request logs.
Track process ancestry on web servers to identify PHP interpreters executing unexpected scripts.

How to Mitigate CVE-2026-100695

Immediate Actions Required

Upgrade Adminer to version 6.0.2 or later on all hosts.
Restrict Adminer access to trusted administrators and internal networks via authentication and network controls.
Revoke the FILE privilege from database accounts used through Adminer unless explicitly required.
Ensure the webroot is not writable by database service accounts in co-located deployments.

Patch Information

The maintainers fixed the issue in Adminer 6.0.2 by properly escaping the CONNECTION_ID() value before interpolating it into JavaScript. Review the GitHub Security Advisory GHSA-7c5h-q78c-fpxx for the fix commit and release notes.

Workarounds

Block connections from Adminer to untrusted or external database servers at the network layer.
Remove Adminer from internet-exposed hosts and place it behind a VPN or IP allowlist.
Separate the Adminer web server from database hosts to prevent database writes to the webroot.
Set the database service account to a low-privilege user without filesystem write access to web directories.

bash

# Configuration example: revoke FILE privilege and restrict Adminer DB account
REVOKE FILE ON *.* FROM 'adminer_user'@'%';
FLUSH PRIVILEGES;

# Verify the privilege has been removed
SHOW GRANTS FOR 'adminer_user'@'%';