CVE-2026-56702: Adminer File Upload RCE Vulnerability

CVE-2026-56702 Overview

CVE-2026-56702 is an unrestricted file upload vulnerability [CWE-434] in Adminer versions before 5.4.3. The flaw resides in the AdminerFileUpload plugin, which ships with a permissive default extension allowlist. Authenticated users can upload PHP files by targeting database columns whose names end in _path. When the configured uploadPath is served by the web server, attackers execute arbitrary PHP code as the web-server user. The issue affects deployments that expose Adminer with the file upload plugin enabled and reachable upload directories.

Critical Impact
Authenticated attackers can upload PHP webshells and achieve remote code execution as the web-server user on the underlying host.

Affected Products

Adminer versions prior to 5.4.3
AdminerFileUpload plugin using the default extension allowlist
Deployments where uploadPath is served directly by the web server

Discovery Timeline

2026-08-25 - CVE-2026-56702 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-56702

Vulnerability Analysis

Adminer is a single-file database management tool written in PHP. The AdminerFileUpload plugin extends Adminer to allow file uploads into database columns whose names match a _path suffix convention. The plugin validates uploaded files against an extension allowlist that is too permissive by default. This allowlist does not exclude executable server-side extensions such as .php, .phtml, or .phar. Authenticated users with database write access can therefore upload files that the web server will interpret as PHP.

Exploitation requires authentication to the Adminer instance, which lowers the attack surface compared to unauthenticated remote code execution. However, Adminer is frequently deployed with shared credentials or exposed to internal users who should not have host-level code execution rights. The vulnerability is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Root Cause

The root cause is an insufficient server-side validation policy in the AdminerFileUpload plugin. The default extension allowlist accepts file types that PHP-enabled web servers execute. The plugin does not enforce a content-type check or strip executable extensions before writing the file to the configured uploadPath.

Attack Vector

An authenticated attacker navigates to a table containing a column ending in _path, edits or inserts a row, and uses the plugin's upload control to submit a PHP file. The plugin writes the file into uploadPath. If the web server serves that directory and processes PHP, the attacker requests the uploaded file and executes arbitrary code as the web-server user. See the GitHub Security Advisory GHSA-vcvj-rwwm-x6g5 and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-56702

Indicators of Compromise

New files with executable extensions such as .php, .phtml, .phar, or .php5 inside the Adminer uploadPath directory.
Outbound connections from the web-server process to unexpected hosts shortly after an Adminer session.
Unusual POST requests to Adminer edit or insert endpoints referencing columns ending in _path.

Detection Strategies

Inspect web server access logs for authenticated Adminer sessions followed by direct requests to files under the plugin's uploadPath.
Alert on process creation from the web-server user (www-data, apache, nginx) spawning shells, curl, wget, or python.
Correlate database write activity in Adminer with file creation events on disk that have PHP-executable extensions.

Monitoring Recommendations

Enable file integrity monitoring on all Adminer plugin uploadPath directories.
Forward web server and Adminer authentication logs to a centralized SIEM for correlation.
Track the version of Adminer running on all hosts and flag installations below 5.4.3.

How to Mitigate CVE-2026-56702

Immediate Actions Required

Upgrade Adminer to version 5.4.3 or later on all internal and internet-facing hosts.
Audit the uploadPath directory for unexpected PHP or executable files and remove any that are unauthorized.
Restrict Adminer access using network controls, IP allowlists, or authenticated reverse proxies.
Rotate database credentials that may have been exposed through a compromised Adminer instance.

Patch Information

The vendor addressed CVE-2026-56702 in Adminer 5.4.3 by tightening the default extension allowlist in the AdminerFileUpload plugin. Refer to the GitHub Security Advisory for the fix commit and release notes.

Workarounds

Disable the AdminerFileUpload plugin until the upgrade to 5.4.3 is complete.
Move uploadPath outside of any web-served directory so uploaded files cannot be executed.
Configure the web server to deny execution of PHP files inside the Adminer upload directory.
Restrict Adminer accounts to read-only database users where write access is not required.

bash

# Example nginx configuration to block PHP execution in the Adminer upload path
location ^~ /adminer/uploads/ {
    location ~ \.(php|phtml|phar|php5)$ {
        deny all;
        return 403;
    }
}