adminer - Debian Package Tracker

general

source: adminer (main)
version: 6.0.0-1
maintainer: Alexandre Rossi (DMD)
arch: all
std-ver: 4.7.4.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.7.9-2
oldstable: 4.8.1-1
stable: 5.2.1+dfsg-1
testing: 6.0.0-1
unstable: 6.0.0-1

versioned links

4.7.9-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.8.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.2.1+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.0.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

adminer (1 bugs: 0, 1, 0, 0)

action needed

A new upstream version is available: 6.0.1 high

A new upstream version 6.0.1 is available, you should consider packaging it.

Created: 2026-08-20 Last update: 2026-08-27 15:21

12 security issues in trixie high

There are 12 open security issues in trixie.

10 important issues:

CVE-2026-16434: Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guard (bootstrap.inc.php) only rejects prefixes matching ^/[^/], blocking //evil.com but allowing values such as /\evil.com whose second character is a backslash. Because browsers normalize backslash to forward slash, a network-path reference survives into REQUEST_URI and reaches cookie_path(), affecting the Set-Cookie Path attribute. Exploitation requires that clients can set the X-Forwarded-Prefix header (a misconfigured or absent reverse proxy). Impact is limited to anomalous cookie-path scoping.
CVE-2026-34959: Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Prefix: https://evil.example) that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This enables an authenticated open redirect after state-changing POSTs, unauthenticated control of the session cookie path attribute, and poisoning of self-referential links; CR/LF cannot be injected, so header splitting/XSS is not possible.
CVE-2026-34964: Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server parameter to bypass the privileged-port restriction and establish TCP connections to arbitrary internal hosts and ports before authentication.
CVE-2026-34967: Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.
CVE-2026-34968: Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.
CVE-2026-56702: Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.
CVE-2026-56703: Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.
CVE-2026-56704: Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.
CVE-2026-56705: Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.
CVE-2026-56706: Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing anyone who observes a single CSRF token (e.g., via network sniffing, log files, Referrer header, or XSS) to recover the session secret with a single XOR operation and forge unlimited valid tokens. The implementation is further weakened by a low-entropy session token (rand(1,1e6), ~20 bits) that permits blind brute-force, and by use of loose comparison (==) in token verification, enabling PHP type juggling. Exploitation enables cross-site request forgery against authenticated sessions, including execution of arbitrary SQL queries.

2 issues left for the package maintainer to handle:

CVE-2026-15686: (needs triaging) Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability. The specific flaw exists within the multi_query method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201.
CVE-2026-63771: (needs triaging) Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-07-21 Last update: 2026-08-26 17:30

14 security issues in bullseye high

There are 14 open security issues in bullseye.

12 important issues:

CVE-2026-15686: Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability. The specific flaw exists within the multi_query method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201.
CVE-2026-16434: Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guard (bootstrap.inc.php) only rejects prefixes matching ^/[^/], blocking //evil.com but allowing values such as /\evil.com whose second character is a backslash. Because browsers normalize backslash to forward slash, a network-path reference survives into REQUEST_URI and reaches cookie_path(), affecting the Set-Cookie Path attribute. Exploitation requires that clients can set the X-Forwarded-Prefix header (a misconfigured or absent reverse proxy). Impact is limited to anomalous cookie-path scoping.
CVE-2026-34959: Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Prefix: https://evil.example) that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This enables an authenticated open redirect after state-changing POSTs, unauthenticated control of the session cookie path attribute, and poisoning of self-referential links; CR/LF cannot be injected, so header splitting/XSS is not possible.
CVE-2026-34964: Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server parameter to bypass the privileged-port restriction and establish TCP connections to arbitrary internal hosts and ports before authentication.
CVE-2026-34967: Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.
CVE-2026-34968: Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.
CVE-2026-56702: Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.
CVE-2026-56703: Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.
CVE-2026-56704: Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.
CVE-2026-56705: Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.
CVE-2026-56706: Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing anyone who observes a single CSRF token (e.g., via network sniffing, log files, Referrer header, or XSS) to recover the session secret with a single XOR operation and forge unlimited valid tokens. The implementation is further weakened by a low-entropy session token (rand(1,1e6), ~20 bits) that permits blind brute-force, and by use of loose comparison (==) in token verification, enabling PHP type juggling. Exploitation enables cross-site request forgery against authenticated sessions, including execution of arbitrary SQL queries.
CVE-2026-63771: Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.

2 issues postponed or untriaged:

CVE-2023-45195: (needs triaging) Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.
CVE-2023-45196: (needs triaging) Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The denial of service is subject to PHP configuration limits. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.

Created: 2026-07-21 Last update: 2026-08-26 17:30

14 security issues in bookworm high

There are 14 open security issues in bookworm.

12 important issues:

CVE-2026-15686: Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability. The specific flaw exists within the multi_query method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-28201.
CVE-2026-16434: Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guard (bootstrap.inc.php) only rejects prefixes matching ^/[^/], blocking //evil.com but allowing values such as /\evil.com whose second character is a backslash. Because browsers normalize backslash to forward slash, a network-path reference survives into REQUEST_URI and reaches cookie_path(), affecting the Set-Cookie Path attribute. Exploitation requires that clients can set the X-Forwarded-Prefix header (a misconfigured or absent reverse proxy). Impact is limited to anomalous cookie-path scoping.
CVE-2026-34959: Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Prefix: https://evil.example) that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This enables an authenticated open redirect after state-changing POSTs, unauthenticated control of the session cookie path attribute, and poisoning of self-referential links; CR/LF cannot be injected, so header splitting/XSS is not possible.
CVE-2026-34964: Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server parameter to bypass the privileged-port restriction and establish TCP connections to arbitrary internal hosts and ports before authentication.
CVE-2026-34967: Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host.
CVE-2026-34968: Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.
CVE-2026-56702: Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.
CVE-2026-56703: Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.
CVE-2026-56704: Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.
CVE-2026-56705: Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed.
CVE-2026-56706: Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing anyone who observes a single CSRF token (e.g., via network sniffing, log files, Referrer header, or XSS) to recover the session secret with a single XOR operation and forge unlimited valid tokens. The implementation is further weakened by a low-entropy session token (rand(1,1e6), ~20 bits) that permits blind brute-force, and by use of loose comparison (==) in token verification, enabling PHP type juggling. Exploitation enables cross-site request forgery against authenticated sessions, including execution of arbitrary SQL queries.
CVE-2026-63771: Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.

2 issues postponed or untriaged:

CVE-2023-45195: (needs triaging) Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.
CVE-2023-45196: (needs triaging) Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The denial of service is subject to PHP configuration limits. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.

Created: 2024-06-28 Last update: 2026-08-26 17:30

2 security issues in buster high

There are 2 open security issues in buster.

2 important issues:

CVE-2023-45195: Adminer and AdminerEvo are vulnerable to SSRF via database connection fields. This could allow an unauthenticated remote attacker to enumerate or access systems the attacker would not otherwise have access to. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.
CVE-2023-45196: Adminer and AdminerEvo allow an unauthenticated remote attacker to cause a denial of service by connecting to an attacker-controlled service that responds with HTTP redirects. The denial of service is subject to PHP configuration limits. Adminer is no longer supported, but this issue was fixed in AdminerEvo version 4.8.4.

Created: 2024-06-28 Last update: 2024-06-28 20:13

RFS: A sponsor is needed to update this package. normal

A Debian contributor is looking for a sponsor to upload a package update. It might be the regular maintainer who does not have any upload right yet, or it might be someone who just wants to help for a bugfix or a new upstream version. In any case, if you have upload rights and care about this package and Debian in general, you should look into sponsoring this update. Please see bug number #1145903 for more information.

Created: 2026-08-27 Last update: 2026-08-27 17:31

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 6.0.1-1, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 12348cfb8f8b96b5daeda722710e568f2e104184
Author: Alexandre Rossi <alexandre.rossi@gmail.com>
Date:   Thu Aug 27 14:26:52 2026 +0200

    Update changelog for 6.0.1-1 release

commit d4fef8cbb720bb15d85a131446f08e4c56536084
Author: Alexandre Rossi <alexandre.rossi@gmail.com>
Date:   Thu Aug 27 14:26:00 2026 +0200

    handle jush move in source tree for build and install

commit 5622f2e32dbec67b2abd6c7bb7a71425500816e8
Merge: e9fb247 8311a63
Author: Alexandre Rossi <alexandre.rossi@gmail.com>
Date:   Thu Aug 27 13:57:54 2026 +0200

    Update upstream source from tag 'upstream/6.0.1'
    
    Update to upstream version '6.0.1'
    with Debian dir fb2e919914a72d6f0753b25e74fbfedcedf880be

commit 8311a63bb5eeb291bfeda9cdd0e147dda7533e97
Author: Alexandre Rossi <alexandre.rossi@gmail.com>
Date:   Thu Aug 27 13:57:53 2026 +0200

    New upstream version 6.0.1

commit e9fb2476d4ef27029e12fe80643651054cda01ed
Author: Alexandre Rossi <alexandre.rossi@gmail.com>
Date:   Thu Aug 27 13:57:20 2026 +0200

    handle jush move in src dist

https://salsa.debian.org/api/v4/projects/debian%2Fadminer API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-08-11 Last update: 2026-08-27 13:33

news

[rss feed]

[2026-08-25] adminer 6.0.0-1 MIGRATED to testing (Debian testing watch)
[2026-08-20] Accepted adminer 6.0.0-1 (source) into unstable (Alexandre Rossi) (signed by: Simon Quigley)
[2026-07-18] adminer 5.4.4+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-07-16] Accepted adminer 5.4.4+dfsg-1 (source) into unstable (Alexandre Rossi) (signed by: Simon Quigley)
[2026-07-14] Accepted adminer 5.4.3+dfsg-1 (source) into unstable (Alexandre Rossi) (signed by: Simon Quigley)
[2026-02-24] adminer 5.4.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2026-02-21] Accepted adminer 5.4.2+dfsg-1 (source) into unstable (Alexandre Rossi) (signed by: Tobias Frost)
[2025-12-19] adminer 5.4.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-12-17] Accepted adminer 5.4.1+dfsg-1 (source) into unstable (Alexandre Rossi) (signed by: bage@debian.org)
[2025-11-25] adminer 5.4.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-11-22] Accepted adminer 5.4.0+dfsg-1 (source) into unstable (Alexandre Rossi) (signed by: bage@debian.org)
[2025-08-21] adminer 5.3.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-08-18] Accepted adminer 5.3.0+dfsg-1 (source) into unstable (Alexandre Rossi) (signed by: xiao sheng wen)
[2025-04-29] adminer 5.2.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2025-04-18] Accepted adminer 5.2.1+dfsg-1 (source) into unstable (Alexandre Rossi) (signed by: xiao sheng wen)
[2025-04-05] adminer 5.1.0-1 MIGRATED to testing (Debian testing watch)
[2025-04-02] Accepted adminer 5.1.0-1 (source) into unstable (Alexandre Rossi) (signed by: Boyuan Yang)
[2024-08-02] adminer 4.8.1-4 MIGRATED to testing (Debian testing watch)
[2024-07-30] Accepted adminer 4.8.1-4 (source) into unstable (Alexandre Rossi) (signed by: Boyuan Yang)
[2024-07-29] adminer REMOVED from testing (Debian testing watch)
[2024-02-06] adminer 4.8.1-2 MIGRATED to testing (Debian testing watch)
[2024-02-01] Accepted adminer 4.8.1-2 (source) into unstable (Alexandre Rossi) (signed by: Chris Lamb)
[2022-08-13] Accepted adminer 4.7.1-1+deb10u1 (source) into oldstable-proposed-updates->oldstable-new, oldstable-proposed-updates (Debian FTP Masters) (signed by: Emilio Pozuelo Monfort)
[2022-05-13] Accepted adminer 4.2.5-3+deb9u3 (source all) into oldoldstable (Chris Lamb)
[2021-08-20] adminer 4.8.1-1 MIGRATED to testing (Debian testing watch)
[2021-08-17] Accepted adminer 4.8.1-1 (source) into unstable (Alexandre Rossi) (signed by: Chris Lamb)
[2021-05-31] adminer 4.7.9-2 MIGRATED to testing (Debian testing watch)
[2021-05-26] Accepted adminer 4.7.9-2 (source) into unstable (Alexandre Rossi) (signed by: Chris Lamb)
[2021-03-05] Accepted adminer 4.7.9-1~bpo10+1 (source all) into buster-backports (Alexandre Rossi) (signed by: Chris Lamb)
[2021-03-02] Accepted adminer 4.2.5-3+deb9u2 (source all) into oldstable (Utkarsh Gupta)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 6.0.0-1