CVE-2026-109347 vrana CVE debrief

Who should care

Defenders responsible for Adminer installations should assess exposure and prioritize upgrading to version 6.1.1 or later. This includes administrators, security teams, and IT personnel who manage Adminer deployments. They should review system configurations, user access controls, and monitor for potential exploitation attempts. Additionally, they should verify that the system is properly patched and that relevant logs are being reviewed.

Why it matters

CVE-2026-109347 is a high-severity vulnerability in Adminer that allows authenticated SQLite users to execute remote code. Defenders should prioritize verifying exposure and upgrading to version 6.1.1 or later.

• Potential remote code execution as the web server user
• Bypassing of ATTACH and VACUUM INTO restrictions
• Execution of PHP code via table names

Technical summary

The vulnerability exists in Adminer before version 6.1.1, allowing authenticated SQLite users to execute remote code by bypassing ATTACH and VACUUM INTO restrictions using a UTF-8 byte-order mark. This enables attackers to attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user. The vulnerability has a high CVSS score of 8.6 and is classified as HIGH severity. Defenders should prioritize verifying exposure of Adminer installations and upgrading to version 6.1.1 or later.

Defensive priority

Defenders should prioritize verifying exposure of Adminer installations and upgrading to version 6.1.1 or later.

Recommended defensive actions

• Verify Adminer installations for exposure
• Upgrade to Adminer version 6.1.1 or later
• Monitor for potential exploitation attempts
• Review system configurations and user access controls
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, there is limited information on potential exploitation or victim impact. Defenders should verify exposure by reviewing system configurations and user access controls. They should also monitor for potential exploitation attempts and review relevant logs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.