Read the docs
TI-2026-20931 Aliases CVE-2026-25892GHSA-q4f2-39gr-45jh

Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

Priority MEDIUM 42CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01693 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed adminer (vrana): 5.4.2vrana/adminer (Packagist): 5.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Admineradminer4.6.2 to before 5.4.25.4.2Patch availableCNA
—vrana/adminer (Packagist)4.6.2 to before 5.4.25.4.2Patch availableGHSA-q4f2-39gr-45jh
  • adminer VendorAdminer Affected 4.6.2 to before 5.4.2 Fixed in 5.4.2 Patch available CNA
  • vrana/adminer (Packagist) Vendor— Affected 4.6.2 to before 5.4.2 Fixed in 5.4.2 Patch available GHSA-q4f2-39gr-45jh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*4.6.2 to before 5.4.2VulnerableAdminer
  • cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:* Versions 4.6.2 to before 5.4.2 Vulnerable ·Adminer

Remediation

  • Fix · CNA adminer (vrana) Fixed in 5.4.2
  • Fix · GHSA-q4f2-39gr-45jh vrana/adminer (Packagist) Fixed in 5.4.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25892
  2. 2026-10-03 Alias added: GHSA-q4f2-39gr-45jh

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2021-04411 SSRF in adminer KEVCVSS 3.1HIGH 7.2
  • TI-2018-05526 Adminer through 4.3.1 has SSRF via the server parameter. CVSS 3.0CRITICAL 9.8
  • TI-2021-19077 Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3)… CVSS 3.1HIGH 7.5
  • TI-2025-28520 Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory… CVSS 3.1HIGH 8.6
  • TI-2021-10333 XSS in doc_link CVSS 3.1HIGH 7.5
  • TI-2020-18079 Adminer through 4.7.8 allows XSS via the history parameter to the default URI. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences