CVE-2026-109347 Overview
CVE-2026-109347 is a remote code execution vulnerability in Adminer versions before 6.1.1. The flaw allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing SQL statements with a UTF-8 byte-order mark (BOM). An attacker can attach a database file at a PHP-served path and create a table whose name contains PHP code. When the web server processes the attached file, the embedded PHP code executes as the web server user. The vulnerability maps to CWE-94: Improper Control of Generation of Code.
Critical Impact
Authenticated SQLite users can achieve remote code execution on the host running Adminer, leading to full compromise of the web server context.
Affected Products
- Adminer versions prior to 6.1.1
- Adminer deployments configured with SQLite driver support
- PHP-based web environments hosting vulnerable Adminer instances
Discovery Timeline
- 2026-10-12 - CVE-2026-109347 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-109347
Vulnerability Analysis
Adminer implements input filters intended to block dangerous SQLite statements such as ATTACH DATABASE and VACUUM INTO. These filters perform string matching on the start of the submitted SQL query. The vulnerability stems from the filter's failure to normalize leading bytes before pattern matching.
An attacker prefixes the SQL statement with a UTF-8 byte-order mark (0xEF 0xBB 0xBF). The filter does not recognize the BOM-prefixed keyword and passes the statement through to the SQLite engine. SQLite tolerates the BOM and executes the statement normally. This bypass restores access to database operations that the application explicitly tried to block.
Root Cause
The root cause is incomplete input sanitization in the SQLite statement allowlist logic. The parser compares raw bytes against reserved keywords without stripping or decoding Unicode control markers. Any character sequence that the SQLite engine ignores but the filter treats as significant produces a bypass primitive.
Attack Vector
Exploitation requires an authenticated session with SQLite privileges inside Adminer. The attacker issues ATTACH DATABASE '/path/to/webroot/file.php' AS pwn with a leading BOM to bypass the filter. Adminer attaches an attacker-controlled file at a PHP-served path on the web server. The attacker then creates a table whose name embeds PHP code, which SQLite writes verbatim into the attached file. Requesting the file through the web server triggers PHP interpretation of the embedded payload, executing arbitrary commands as the web server user. Full technical details are available in the GitHub Security Advisory GHSA-r9r5-j5q8-8c59 and the VulnCheck Advisory for RCE.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-109347
Indicators of Compromise
- Unexpected .php files appearing in web-accessible directories owned by the web server process.
- Adminer query logs or PHP access logs containing SQL statements beginning with the byte sequence 0xEF 0xBB 0xBF followed by ATTACH or VACUUM.
- SQLite database files with unusual extensions such as .php, .phtml, or .phar under Adminer-reachable paths.
Detection Strategies
- Inspect Adminer and PHP request logs for POST bodies containing a UTF-8 BOM prefix adjacent to SQL keywords.
- Monitor file integrity on web root directories to flag new or modified PHP files written by the web server UID.
- Review authentication logs for Adminer sessions executing ATTACH DATABASE or VACUUM INTO on SQLite connections.
Monitoring Recommendations
- Enable PHP access_log and web application firewall logging that preserves raw request bodies rather than normalized text.
- Alert on web shell behavioral patterns such as php-fpm or apache2 processes spawning shells or network connections.
- Correlate Adminer login events with subsequent file-write telemetry on the hosting server.
How to Mitigate CVE-2026-109347
Immediate Actions Required
- Upgrade Adminer to version 6.1.1 or later on all deployments.
- Restrict network access to Adminer interfaces using IP allowlists, VPNs, or authentication proxies.
- Audit web root directories for unexpected PHP files and remove any unauthorized content.
- Rotate credentials for all database accounts that were accessible through the vulnerable Adminer instance.
Patch Information
The maintainers released Adminer 6.1.1 with a corrected SQL filter that strips or rejects leading BOM sequences before keyword comparison. Administrators should download the fixed release from the official Adminer project and redeploy. Refer to the GitHub Security Advisory GHSA-r9r5-j5q8-8c59 for upgrade guidance.
Workarounds
- Disable the SQLite driver in Adminer configuration if SQLite management is not required.
- Configure the web server to deny execution of PHP files outside explicit application directories.
- Place Adminer behind an authenticating reverse proxy to prevent unauthenticated reconnaissance.
- Run the PHP-FPM pool for Adminer under a dedicated low-privilege user with no write access to the document root.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
