CVE-2026-100695

Executive Summary

CVE-2026-100695 is a stored/reflected cross-site scripting (XSS) vulnerability in Adminer versions prior to 6.0.2, where the result of the database CONNECTION_ID() function is interpolated directly into JavaScript output without proper escaping. A malicious or attacker-controlled database server can return a crafted CONNECTION_ID() value that executes arbitrary JavaScript within the authenticated Adminer origin when a user is connected.

The impact is rated CVSS 6.1 (Medium) — the XSS itself carries only Low confidentiality and integrity impact directly, but the description notes an escalation path: in co-located deployments where the database has FILE privileges and can write to the webroot, the injected JavaScript can be leveraged to submit authenticated SQL requests that write PHP files via INTO DUMPFILE, achieving remote code execution (RCE) as the web server account. Adminer is widely deployed as a lightweight, single-file database administration tool, making this relevant to any environment where administrators connect Adminer to a database server they do not fully control or trust.

Technical Analysis

Adminer is a single-file PHP database administration tool that supports MySQL, MariaDB, PostgreSQL, SQLite, MS SQL, Oracle, and others. Version 6.0.x introduced a JavaScript-based connection monitoring mechanism that periodically queries the database to determine whether the underlying connection is still alive. The CONNECTION_ID() SQL function — a standard MySQL/MariaDB function that returns the current connection's thread identifier — is used for this purpose. The value returned by CONNECTION_ID() is a per-connection integer on legitimate servers.

The vulnerability is a classic output-context mismatch: the value returned by the database server is interpolated into a JavaScript context without the appropriate escaping (CWE-79, Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). Because the value originates from the database server rather than the browser request, the developer may have assumed it was trustworthy and safe to embed directly. An attacker who controls, compromises, or otherwise influences the database server's response can return a CONNECTION_ID() value that, when embedded into the generated JavaScript, breaks out of the string/numeric context and injects attacker-controlled script.

Two properties make this especially dangerous:

1. Trust boundary inversion. In Adminer's normal model, the user authenticates to Adminer and connects to a database they control. This vulnerability works in the opposite direction — the database server supplies the malicious input. Any deployment where an administrator connects to a database server that is not fully trusted (hosted databases, shared infrastructure, third-party DBaaS endpoints now under attacker control, or a database that has already been compromised) becomes an attack vector.

2. Privileged execution context. The injected script runs in the origin of the authenticated Adminer session. It therefore executes with the user's already-established Adminer session privileges, has access to the Adminer DOM and AJAX request machinery, and can issue authenticated requests to Adminer's own endpoints on the user's behalf — including SQL execution via the query interface.

No public proof-of-concept, Nuclei template, or exploit code is known at the time of writing. All exploitation detail below is inferred strictly from the vulnerability class and the NVD description; no specific function names, endpoints, or parameters beyond those stated in the description are asserted.

Exploitation Scenarios

The following attack chain is derived strictly from the NVD description for CVE-2026-100695. No public exploit is available; the chain is inferred from the vulnerability class.

1. Precondition / target identification. The attacker needs the victim to connect an Adminer instance (< 6.0.2) to a database server whose responses the attacker can control or influence. This can be achieved by: compromising or operating a database host that administrators connect to; positioning as a man-in-the-middle on the database connection (if TLS is not enforced or is improperly validated); or controlling a rogue database endpoint. Adminer is frequently used to connect to remote/cloud database instances, so this precondition is realistic.

2. Triggering the flaw. When the authenticated user's Adminer session performs its connection-liveness query, the malicious server returns a crafted value for CONNECTION_ID() instead of a legitimate thread identifier. Because Adminer interpolates that value into JavaScript without proper escaping, the server-controlled value is rendered into the page in the Adminer origin.

3. Payload / execution class. The injected value breaks out of its JavaScript context and executes arbitrary JavaScript in the authenticated Adminer origin. Because the script runs in that origin, it can read page context, issue same-origin authenticated requests, and — critically — invoke Adminer's SQL-query capability as the logged-in user. This is the XSS execution stage; no specific DOM sink or endpoint name is asserted, as the description does not provide them.

4. Privilege escalation to RCE. In co-located deployments where the database user has FILE privileges and the database server process can write to the web server's document root (webroot), the injected JavaScript can be used to submit an authenticated SQL request that writes a PHP file into the webroot via INTO DUMPFILE. That PHP file can then be requested over HTTP, executing with the web server account's privileges — a full remote code execution path. This escalation depends on two environmental conditions: database FILE privileges and the ability of the database to write into the webroot.

Note: The CVSS vector (PR:N/UI:R/S:C) reflects that exploitation requires the victim to have an authenticated Adminer session (User Interaction), while the scope change (S:C) reflects the pivot from the database-supplied value to the web/Adminer origin and the potential RCE impact.

Impact Assessment

The CVSS v3.1 base score is 6.1 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

• Attack Vector (Network): The attack is delivered over the network via the database connection; no local access is required.
• Attack Complexity (Low): No special conditions beyond the victim connecting to an attacker-influenced database are noted.
• Privileges Required (None): The attacker needs no prior privileges on Adminer itself.
• User Interaction (Required): The victim must have an active authenticated Adminer session and trigger the connection-check flow.
• Scope (Changed): The vulnerable component is the database-result handling, but the impact crosses into the Adminer/web origin — and potentially the web server account via RCE.
• Confidentiality / Integrity (Low each) / Availability (None): Reflecting the XSS as the primary scored impact.

Business impact: In the direct (XSS-only) case, an attacker can execute JavaScript in an authenticated administrator's Adminer session, potentially reading exposed data or performing actions as that admin. The severe case is the described escalation: remote code execution as the web server account in co-located deployments where the database holds FILE privileges and can write to the webroot. RCE on the web server can lead to full compromise of the application, lateral movement to backend systems, and data exfiltration.

Blast radius: Any organization running Adminer < 6.0.2 and connecting it to a database server that is not strictly trusted. The trigger is the database server, not the client, so environments with hosted, multi-tenant, or otherwise externally influenced databases are most exposed. Co-located deployments (database and web server on the same host with a writable webroot and a privileged database user) represent the highest-risk configuration.

Detection Guidance

Sigma Rule

title: Adminer CONNECTION_ID XSS to INTO DUMPFILE PHP Write
id: 3f6a2b10-9c4e-4d2a-8f1e-adminer2026
status: experimental
description: Detects SQL statements written via INTO DUMPFILE targeting PHP files, consistent with post-XSS escalation in CVE-2026-100695
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100695
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: apache
  definition: Requires web server logs or DB audit logs capturing Adminer SQL queries
detection:
  selection_query:
    - 'INTO DUMPFILE'
    - 'INTO OUTFILE'
  selection_php:
    - '.php'
  condition: all of selection_*
fields:
  - clientip
  - uri
  - query
falsepositives:
  - Administrative export operations writing non-PHP files
level: high

YARA Rule

rule CVE_2026_100695_Adminer_CONNECTION_ID_XSS
{
    meta:
        author = "valtersit.com"
        description = "Detects SQL content attempting to write PHP payloads via INTO DUMPFILE, associated with CVE-2026-100695 escalation"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100695"
        date = "2026-01-01"
    strings:
        $dumpfile = "INTO DUMPFILE" nocase
        $outfile  = "INTO OUTFILE" nocase
        $php1     = "<?php" ascii
        $connid   = "CONNECTION_ID()" nocase
    condition:
        (uint16be(0) == 0x3C3F or $connid or any of ($dumpfile, $outfile)) and
        ($dumpfile or $outfile) and $php1
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100695 Adminer XSS - INTO DUMPFILE PHP write attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"Adminer"; nocase; http.request_body; content:"INTO DUMPFILE"; nocase; http.request_body; content:"<?php"; nocase; reference:cve,2026-100695; classtype:web-application-attack; sid:2026100695; rev:1;)

Elastic Detection

sequence by source.ip, user.name with maxspan=2m
  [ network where network.protocol == "mysql" or network.protocol == "postgresql" ]
  [ http.request where http.request.method == "POST" and
      http.request.body.content : ("*INTO DUMPFILE*" or "*INTO OUTFILE*") and
      http.request.body.content : "*.php*" ]

/* Alert: SQL file-write primitive observed followed by Adminer HTTP query submission,
   consistent with CVE-2026-100695 XSS-driven RCE escalation. */

Splunk SPL Query

index=web OR index=db sourcetype=access_combined OR sourcetype=mysql_audit
| eval payload = lower(_raw)
| where (match(payload,"into\s+dumpfile") OR match(payload,"into\s+outfile")) AND match(payload,"\.php")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,adminer,">
  <rule id="100695" level="12">
    <if_sid>31100,31101,31103</if_sid>
    <match>INTO DUMPFILE|INTO OUTFILE</match>
    <match>\.php</match>
    <description>CVE-2026-100695: Possible Adminer XSS-driven SQL file write to PHP (RCE escalation attempt)</description>
    <mitre>
      <id>T1505.003</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations (in the absence of a verified patch):

   • Treat all database servers that Adminer connects to as untrusted input sources; do not connect Adminer < 6.0.2 to database hosts you do not fully control or trust.
   • Where feasible, restrict the database account used in Adminer from holding FILE privileges, eliminating the INTO DUMPFILE write primitive required for the RCE escalation path.
   • Ensure the database server process cannot write to the web server's document root (remove co-location of writable database and webroot).
   • Deploy Adminer behind an authenticated reverse proxy, restrict access by IP allow-list, and avoid exposing it to the public internet.
   • Enforce TLS with strict certificate validation on database connections to reduce man-in-the-middle delivery of a malicious CONNECTION_ID() value.

2. Patch / upgrade steps:

   • The NVD description states the issue is addressed in Adminer 6.0.2. Upgrade to 6.0.2 or later; because this report's tracked sources show no confirmed patch evidence (0/4), independently verify the fix in the upstream Adminer release before relying on it, and confirm the exact fixed version against the vendor's official release notes.
   • After upgrading, validate that CONNECTION_ID() results are properly escaped/validated in the JavaScript output context.

3. Long-term hardening:

   • Apply the principle of least privilege to all database accounts used by database-administration tools (no FILE or superuser privileges unless explicitly required).
   • Separate the database host from the web server host (avoid co-located deployments with writable webroots).
   • Implement Content Security Policy (CSP) headers to reduce the impact of any XSS in Adminer's origin.
   • Maintain an inventory of Adminer and other admin-tool deployments, monitor upstream advisories, and adopt a standard upgrade cadence for externally reachable administrative interfaces.
   • Enable database audit logging and web server logging, and alert on INTO DUMPFILE/INTO OUTFILE patterns writing to web-accessible paths.

References

• NVD — CVE-2026-100695: https://nvd.nist.gov/vuln/detail/CVE-2026-100695
• Adminer project (upstream release/source): https://www.adminer.org/
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
• MITRE ATT&CK T1505.003 — Server Software Component: Web Shell: https://attack.mitre.org/techniques/T1505/003/

No public PoC, Nuclei template, or exploit code was identified, and no CISA KEV entry or confirmed exploit-in-the-wild activity was recorded in the provided data at the time of writing. No threat actor campaigns are attributed to this CVE.