CVE-2026-56705: Adminer ODBC Parameter Injection RCE

CVE-2026-56705 Overview

CVE-2026-56705 is a remote code execution vulnerability in Adminer before version 5.4.3. The flaw exists in how Adminer constructs a PHP Data Objects (PDO) Data Source Name (DSN) string for Microsoft SQL Server connections. Adminer fails to sanitize the server field, allowing attackers to inject Open Database Connectivity (ODBC) parameters using semicolons. Unauthenticated attackers can inject TraceFile and TraceOn parameters to write PHP code into the web root. Accessing the resulting trace file triggers execution of attacker-controlled PHP, yielding full remote code execution on the host running Adminer.

Critical Impact
Unauthenticated attackers reachable over the network can write arbitrary PHP to the web root and execute code in the Adminer server context.

Affected Products

Adminer versions prior to 5.4.3
Adminer deployments configured with the Microsoft SQL Server (MSSQL) PDO driver
Web applications bundling vulnerable Adminer builds

Discovery Timeline

2026-08-25 - CVE-2026-56705 published to the National Vulnerability Database (NVD)
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-56705

Vulnerability Analysis

Adminer is a single-file PHP database management tool. When a user submits connection details for an MSSQL backend, Adminer builds a PDO DSN string that is passed to the underlying ODBC driver. The server field supplied by the client is concatenated into this DSN without sanitization of the semicolon character. Because semicolons delimit ODBC key-value pairs, an attacker can append arbitrary parameters recognized by the driver. The TraceFile and TraceOn parameters instruct the ODBC layer to write a debug trace to a file path chosen by the attacker. By seeding the server value with embedded PHP, the attacker causes the trace file to contain executable PHP tags. This weakness is tracked as [CWE-73] External Control of File Name or Path.

Root Cause

The root cause is missing input validation on the server parameter before DSN construction. Adminer treats the server string as opaque and does not escape or reject the semicolon delimiter used by ODBC. Attacker-controlled content therefore reaches privileged driver configuration keys.

Attack Vector

Exploitation requires network access to the Adminer login page and does not require authentication or user interaction. The attacker submits a login request whose server field contains additional ODBC key-value pairs. The malicious value sets TraceFile to a writable path inside the web root, such as a .php file, and enables TraceOn. The ODBC driver then writes the trace containing attacker-supplied PHP source code. A follow-up HTTP request to that file executes the injected code under the web server user. Technical details are documented in the GitHub Security Advisory GHSA-r4x9-5m63-3vxw and the VulnCheck Advisory.

Detection Methods for CVE-2026-56705

Indicators of Compromise

Unexpected .php files under the Adminer web root with timestamps matching recent login attempts
Files whose contents interleave ODBC trace output with PHP tags such as <?php
POST requests to adminer.php containing semicolons in the server parameter
Requests referencing TraceFile or TraceOn strings in login payloads

Detection Strategies

Inspect web server access logs for login submissions where the server field contains ;, TraceFile=, or TraceOn=
Alert on creation of PHP files inside directories that host Adminer or that are writable by the PHP process
Correlate outbound connections from the web server user to unexpected hosts following Adminer login events
Review PDO and ODBC driver logs for unusual trace configuration values

Monitoring Recommendations

Enable file integrity monitoring on Adminer installation directories and PHP-served paths
Forward web server, PHP error, and ODBC driver logs to a centralized analytics platform for retention and search
Monitor process creation events under the web server account for shell interpreters spawned by PHP

How to Mitigate CVE-2026-56705

Immediate Actions Required

Upgrade Adminer to version 5.4.3 or later on all hosts
Restrict network access to Adminer with IP allowlists, VPN, or authenticated reverse proxies
Audit the web root for unexpected .php files and remove any that contain ODBC trace fragments
Rotate database credentials that were reachable through the exposed Adminer instance

Patch Information

The Adminer maintainers released version 5.4.3, which sanitizes the server field before DSN construction. Details are published in the GitHub Security Advisory GHSA-r4x9-5m63-3vxw. Administrators should replace the deployed adminer.php file with the fixed release and verify version strings after deployment.

Workarounds

Remove Adminer from production hosts when it is not actively required for administration
Block use of the MSSQL PDO driver in Adminer configurations that cannot be updated
Place Adminer behind authentication enforced at the web server or reverse proxy layer
Configure the web root to disallow PHP execution from directories writable by the ODBC driver

bash

# Configuration example: deny PHP execution in a directory writable by the ODBC trace driver
<Directory "/var/www/html/adminer-tmp">
    php_admin_flag engine off
    <FilesMatch "\.ph(p[3-7]?|tml)$">
        Require all denied
    </FilesMatch>
</Directory>