CVE-2026-96633: AdminNeo SQLite Database-List Drop Arbitrary File Deletion

October 30, 2026

AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db[] values directly to unlink().

Originally reported by @slpoiuewalspoid-dotcom in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-6pg3-chwq-wgqc

References

github.com/adminneo-org/adminneo/commit/26fcef2f32922629751cbea6c0bb593fbf1e957d
github.com/adminneo-org/adminneo/releases/tag/v5.5.1
github.com/adminneo-org/adminneo/security/advisories/GHSA-6vfx-w7q3-42gq
github.com/advisories/GHSA-6vfx-w7q3-42gq
nvd.nist.gov/vuln/detail/CVE-2026-96633

Code Behaviors & Features

Detect and mitigate CVE-2026-96633 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →