CVE-2026-56703: Adminer SQLite RCE Vulnerability

CVE-2026-56703 is a remote code execution vulnerability in Adminer versions before 5.4.3 affecting SQLite query handling. Authenticated attackers can exploit VACUUM INTO commands to write malicious PHP code and execute arbitrary commands on the server. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-56703 Overview

CVE-2026-56703 is a remote code execution vulnerability in Adminer, the popular PHP-based database management tool. Versions before 5.4.3 fail to block the SQLite VACUUM INTO statement despite restrictions on the ATTACH command. Authenticated attackers can abuse VACUUM INTO to write PHP code to arbitrary file paths on the web server. Once the attacker writes a PHP payload inside the web root, they execute commands under the privileges of the PHP process. The flaw is classified under CWE-94 (Improper Control of Generation of Code).

Critical Impact
Authenticated Adminer users can achieve remote code execution on the underlying server by writing PHP files to web-accessible directories through SQLite VACUUM INTO.

Affected Products

Adminer versions before 5.4.3
Adminer deployments with SQLite driver enabled
Web servers hosting Adminer with PHP file execution in the same directory

Discovery Timeline

2026-08-25 - CVE-2026-56703 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-56703

Vulnerability Analysis

Adminer provides a web-based interface for managing multiple database engines, including SQLite. To prevent file-write attacks, Adminer historically blocked the SQLite ATTACH DATABASE statement, which can create files at attacker-controlled paths. The fix was incomplete. SQLite exposes a second mechanism, VACUUM INTO, that also writes a complete database file to a specified filesystem location.

An authenticated attacker with access to Adminer's SQLite query interface can craft a database whose contents include valid PHP code embedded within table data or schema. The attacker then issues VACUUM INTO '/var/www/html/shell.php' to write that database file, containing PHP tags, to a directory served by the web server. Requesting the resulting file causes PHP to interpret the embedded payload and execute arbitrary commands.

Root Cause

The root cause is an incomplete blocklist. Adminer's SQL command filter prevented ATTACH but did not enumerate other SQLite statements capable of producing files. VACUUM INTO was introduced in SQLite 3.27 and was overlooked, allowing arbitrary file writes despite the intended restriction.

Attack Vector

Exploitation requires authenticated access to an Adminer instance configured for SQLite. The attacker submits a VACUUM INTO statement whose target path resolves inside the web root or another location loaded by the PHP runtime. The written file combines SQLite header bytes with attacker-controlled table content, and PHP tolerates the binary prefix while executing the embedded <?php ... ?> block. Refer to the GitHub Security Advisory and the VulnCheck advisory for technical detail.

Detection Methods for CVE-2026-56703

Indicators of Compromise

New or modified .php files inside directories writable by the web server user, especially near the Adminer installation path
SQLite database files placed under web-accessible paths such as /var/www/, htdocs/, or public_html/
Adminer access logs showing SQLite sessions followed by requests to previously nonexistent PHP files
Outbound network connections from the PHP process to unexpected destinations after Adminer usage

Detection Strategies

Inspect Adminer query history and web server logs for POST requests containing VACUUM INTO strings
Alert on file creation events where the parent process is php-fpm, apache2, or httpd writing files with .php extensions
Monitor for SQLite driver usage in Adminer within environments where SQLite is not an expected backend

Monitoring Recommendations

Enable web server access logging with full request bodies or use a web application firewall to capture SQL payloads sent to Adminer
Baseline the Adminer installation directory and alert on any file additions outside patch windows
Correlate authentication events against Adminer with subsequent process execution from the web user account

How to Mitigate CVE-2026-56703

Immediate Actions Required

Upgrade Adminer to version 5.4.3 or later, which blocks VACUUM INTO in the SQLite driver
Restrict network access to Adminer using IP allowlists, VPN, or authentication proxies
Rotate any Adminer credentials that may have been exposed on internet-facing installations
Audit web-accessible directories for unauthorized PHP files created since the installation of vulnerable Adminer versions

Patch Information

Adminer 5.4.3 addresses CVE-2026-56703 by extending the SQL statement filter to reject VACUUM INTO alongside ATTACH. Download the fixed release from the Adminer project and review the GitHub Security Advisory GHSA-gmx3-g29w-77wf for change details.

Workarounds

Remove the SQLite driver from the Adminer deployment if SQLite management is not required
Configure the web server to deny PHP execution in directories that must be writable by the PHP process
Deploy a web application firewall rule that blocks HTTP requests to Adminer containing the token VACUUM INTO
Place Adminer behind an authenticated reverse proxy so unauthenticated attackers cannot reach the query interface

bash

# Example WAF rule concept (ModSecurity) to block VACUUM INTO in Adminer requests
SecRule REQUEST_URI "@contains adminer" \
  "chain,phase:2,deny,status:403,id:1026567030,msg:'Block SQLite VACUUM INTO write attempt (CVE-2026-56703)'"
  SecRule ARGS|REQUEST_BODY "@rx (?i)vacuum\s+into" "t:none"