CVE-2026-34968: Adminer SQLite Path Traversal Vulnerability

CVE-2026-34968 Overview

CVE-2026-34968 is an arbitrary file deletion vulnerability in Adminer, a PHP-based database management tool. Versions before 5.4.3 fail to validate file extensions in the SQLite database-list drop action. An authenticated attacker can submit crafted relative file paths in the db[] parameter to delete any file writable by the PHP process. The flaw is classified under [CWE-22] (Path Traversal) and affects Adminer installations configured in SQLite mode.

Critical Impact
Authenticated attackers can delete arbitrary files on the host, including application source files, configuration data, and web content, leading to integrity and availability loss.

Affected Products

Adminer versions prior to 5.4.3
Adminer deployments running in SQLite mode
PHP applications bundling vulnerable Adminer releases

Discovery Timeline

2026-08-25 - CVE-2026-34968 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-34968

Vulnerability Analysis

Adminer exposes a database management interface that, in SQLite mode, treats database entries as files on disk. The drop operation accepts an array of database names via the db[] HTTP parameter and calls a file deletion routine on each entry. Versions before 5.4.3 do not restrict the deletion target to SQLite database files. The routine also does not normalize or constrain the submitted path.

An authenticated user can therefore submit relative paths such as ../../config.php and cause Adminer to unlink files outside the intended database directory. Any file the PHP process user can write is a valid target for deletion.

Root Cause

The root cause is missing input validation on the db[] parameter in the SQLite drop handler. The code neither checks that each entry ends with a recognized SQLite extension nor confines paths to a designated database directory. This combination of missing extension allowlisting and missing path canonicalization enables directory traversal.

Attack Vector

Exploitation requires an authenticated Adminer session with access to the SQLite driver. The attacker issues an HTTP POST to the database drop endpoint with one or more db[] values containing relative path segments. Adminer resolves the path against its working directory and deletes the resulting file. No user interaction beyond the attacker's own authenticated request is required. Refer to the GitHub Security Advisory GHSA-6pg3-chwq-wgqc and the VulnCheck Advisory on Adminer for additional technical detail.

Detection Methods for CVE-2026-34968

Indicators of Compromise

HTTP POST requests to Adminer with db[] parameter values containing ../ or absolute path segments
Unexpected file deletion events on the web server originating from the PHP process user
Missing application configuration files, .htaccess files, or web content following an Adminer session
Adminer access logs showing SQLite driver selection followed by drop actions on unusual names

Detection Strategies

Inspect web server and PHP-FPM logs for Adminer drop requests referencing paths outside the SQLite database directory
Correlate authenticated Adminer sessions with filesystem unlink syscalls on non-database file paths
Deploy web application firewall rules that flag traversal sequences in db[] parameters submitted to Adminer

Monitoring Recommendations

Enable filesystem auditing on directories that host Adminer, application code, and configuration
Alert on deletions of critical files performed by the web server user during active HTTP sessions
Track Adminer version strings across the estate and flag hosts below 5.4.3

How to Mitigate CVE-2026-34968

Immediate Actions Required

Upgrade Adminer to version 5.4.3 or later on all hosts
Restrict Adminer access to trusted networks and authenticated administrators only
Audit filesystem permissions so the PHP process cannot write to source or configuration files
Review recent Adminer access logs for drop actions containing traversal patterns

Patch Information

The upstream fix is included in Adminer 5.4.3. The maintainers added validation on the SQLite drop path so only files matching the expected database extension inside the configured directory can be removed. See the GitHub Security Advisory GHSA-6pg3-chwq-wgqc for release notes and patch commits.

Workarounds

Disable the SQLite driver in Adminer if it is not required for operations
Place Adminer behind an authenticating reverse proxy or IP allowlist
Run the PHP process under a dedicated user with read-only access to application code and configuration
Remove Adminer from production hosts and use it only on demand from an isolated management network

bash

# Configuration example: restrict Adminer to a specific admin network in nginx
location /adminer/ {
    allow 10.0.10.0/24;
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}