CVE-2026-96630: AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)

October 30, 2026

Adminer blocks ATTACH queries for SQLite to prevent arbitrary file creation. However, VACUUM INTO is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands.

Originally reported in Adminer: GHSA-q4f2-39gr-45jh

References

github.com/adminneo-org/adminneo/commit/cf45efb3ac34e5e7b699cdc996f6eec2814ccda1
github.com/adminneo-org/adminneo/releases/tag/v5.5.1
github.com/adminneo-org/adminneo/security/advisories/GHSA-q5mp-gfjf-cf2j
github.com/advisories/GHSA-q5mp-gfjf-cf2j
nvd.nist.gov/vuln/detail/CVE-2026-96630

Code Behaviors & Features

Detect and mitigate CVE-2026-96630 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →