CVE-2026-34967: Adminer SQL Log Path Traversal Vulnerability

CVE-2026-34967 Overview

CVE-2026-34967 is an arbitrary file write vulnerability in Adminer, a popular PHP-based database management tool. The flaw affects Adminer versions 5.3.0 through 5.4.2 when the sql-log plugin is enabled. Attackers exploit the ns parameter in plugins/sql-log.php, which fails to sanitize path traversal sequences. An authenticated user can write attacker-controlled .sql files to any directory writable by the web server process. The issue is tracked as [CWE-73: External Control of File Name or Path].

Critical Impact
Authenticated attackers can write arbitrary .sql files to any writable location on the host, enabling configuration tampering, log poisoning, or staging for follow-on code execution.

Affected Products

Adminer 5.3.0 through 5.4.2 with the sql-log plugin enabled
plugins/sql-log.php component
Deployments exposing Adminer to authenticated users with database access

Discovery Timeline

2026-08-25 - CVE-2026-34967 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-34967

Vulnerability Analysis

Adminer ships an optional sql-log plugin that records executed SQL statements to disk. The plugin accepts an ns (namespace) parameter to organize log files. The plugin concatenates the ns value into a file path without validating or normalizing traversal sequences. An authenticated attacker submits crafted values containing ../ segments to escape the intended log directory. The server then writes a .sql file, containing attacker-influenced SQL content, to the resolved location.

Because the attacker controls both the destination path and the file body, this primitive supports several attack chains. Writing to a web-accessible directory can place attacker content under a static path. Writing over configuration files can alter application behavior. Writing to scheduled task input directories or PHP include paths can escalate to code execution depending on host configuration.

Root Cause

The root cause is missing path canonicalization on the ns parameter in plugins/sql-log.php. The plugin trusts user-supplied input to construct a filesystem path and does not restrict writes to a fixed base directory. This is a classic [CWE-73] weakness: external control of a file name or path used in a sensitive filesystem operation.

Attack Vector

Exploitation requires network access to the Adminer interface and valid credentials to authenticate to a database. The attacker submits a request that triggers sql-log logging while supplying a traversal payload in the ns parameter. The vulnerable code path writes attacker-supplied SQL content to the resolved location. No user interaction beyond the authenticated request is required. For technical specifics, refer to the GitHub Security Advisory GHSA-75xm-qwfq-9wp5 and the VulnCheck Advisory on Adminer SQL Log Plugin.

No verified public proof-of-concept code is available at publication time.

Detection Methods for CVE-2026-34967

Indicators of Compromise

Unexpected .sql files appearing outside the configured sql-log output directory, particularly under web roots, cron directories, or PHP include paths.
HTTP requests to plugins/sql-log.php or Adminer endpoints containing ../, ..%2f, or URL-encoded traversal sequences in the ns parameter.
Modified timestamps on writable directories owned by the web server user without a corresponding deployment event.

Detection Strategies

Inspect web server access logs for requests to Adminer that include suspicious values in the ns query parameter or POST body.
Enable filesystem integrity monitoring on directories writable by the PHP/web process, and alert on new .sql files outside the expected log path.
Correlate authenticated Adminer sessions with file creation events on the host to identify traversal attempts.

Monitoring Recommendations

Forward web server, PHP-FPM, and filesystem audit logs to a centralized analytics platform for retention and correlation.
Baseline the expected sql-log output path and alert on deviations.
Track outbound behavior from the Adminer host to detect follow-on payload retrieval or execution triggered by written files.

How to Mitigate CVE-2026-34967

Immediate Actions Required

Upgrade Adminer to a version released after 5.4.2 that addresses the ns parameter handling in plugins/sql-log.php.
Disable the sql-log plugin if it is not required for operations.
Restrict network access to Adminer using firewall rules, VPN, or IP allowlists so it is not exposed to the public internet.
Rotate database credentials that were reachable through the affected Adminer instance.

Patch Information

Refer to the GitHub Security Advisory GHSA-75xm-qwfq-9wp5 for the fixed version and remediation details. The advisory is the authoritative source for the patched release identifier and upgrade guidance.

Workarounds

Remove or comment out the sql-log plugin registration in the Adminer configuration until the patch is applied.
Run Adminer under a low-privilege user account with a narrowly scoped writable directory to limit blast radius.
Enforce strong authentication in front of Adminer, such as HTTP basic auth or a reverse proxy with SSO, to reduce the pool of users capable of triggering the flaw.

bash

# Configuration example: remove sql-log plugin from Adminer bootstrap
# Edit your Adminer index/plugin loader and comment out the sql-log entry
# Example (illustrative):
#   new AdminerSqlLog('/var/log/adminer/'),
# becomes:
# // new AdminerSqlLog('/var/log/adminer/'),

# Restrict Adminer to internal networks via nginx
location /adminer/ {
    allow 10.0.0.0/8;
    deny  all;
}