GHSA-49h4-j9cq-22wgMediumCVSS 5.4

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file...

Published
August 25, 2026
Last Modified
August 25, 2026

🔗 CVE IDs covered (1)

📋 Description

Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.

🔗 References (4)