What is GHSA-34q8-53jm-qc2r?

GHSA-34q8-53jm-qc2r is a security advisory published by GitHub Security Advisories with Critical severity. Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string,...

Which CVE IDs does GHSA-34q8-53jm-qc2r cover?

GHSA-34q8-53jm-qc2r covers the following CVE IDs: CVE-2026-56705. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-34q8-53jm-qc2r?

GHSA-34q8-53jm-qc2r has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-34q8-53jm-qc2rCriticalCVSS 9.8

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string,...

Vendor

GitHub Security Advisories

Published

August 25, 2026

Last Modified

August 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-56705 →

📋 Description

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.

🔗 References (4)

https://github.com/vrana/adminer/security/advisories/GHSA-r4x9-5m63-3vxw
https://nvd.nist.gov/vuln/detail/CVE-2026-56705
https://www.vulncheck.com/advisories/adminer-before-remote-code-execution-via-mssql-pdo-dsn-injection
https://github.com/advisories/GHSA-34q8-53jm-qc2r