CVE-2026-109347

Executive Summary

CVE-2026-109347 is a remote code execution vulnerability in Adminer versions prior to 6.1.1 that affects authenticated SQLite users. By prefixing SQL statements with a UTF-8 byte-order mark, an attacker can bypass the application's ATTACH and VACUUM INTO restrictions, attach an attacker-controlled database file located at a PHP-served path, and create a table whose name contains PHP code that executes as the web server user. With a CVSS Base score of 7.2 (High), the flaw requires authenticated access (PR:H) but delivers full confidentiality, integrity, and availability impact to the hosting system.

Technical Analysis

Adminer is a single-file PHP database administration tool commonly deployed as a web-accessible interface for MySQL, PostgreSQL, SQLite, and other database engines. The vulnerability centers on how Adminer validates user-supplied SQL intended for execution against an SQLite backend.

The application implements restrictions designed to prevent dangerous file-system-oriented SQLite commands — specifically ATTACH (which mounts an external database file into the current session) and VACUUM INTO (which writes database contents to an arbitrary file path). These restrictions form the primary control preventing an authenticated database user from reading or writing arbitrary files on the underlying host.

Per the NVD description, the bypass is achieved by prefixing an otherwise-restricted statement with a UTF-8 byte-order mark (BOM, the byte sequence EF BB BF). The BOM is a zero-width character used to signal text encoding; when it precedes a statement, Adminer's parsing/normalization logic fails to recognize the statement as a restricted ATTACH or VACUUM INTO command, allowing it to pass validation. SQLite itself tolerates and ignores the leading BOM when it processes the statement, so the command executes despite having been "hidden" from the filter.

This is a canonical filter-evasion defect mapped to CWE-94 (Improper Control of Generation of Code — "Code Injection"). The parser and the underlying engine disagree on how to interpret the same input, and that semantic gap is the vulnerability.

The attack surface is the authenticated SQLite query interface. Because the operations bypassed are file-oriented, the effective surface extends beyond the database process to the host file system reachable by the PHP process. The critical enabling condition described is that the attacker can "attach a database file at a PHP-served path" — meaning a location that the web server will serve and that PHP will interpret. Creating a table within that attached database, with the table name itself crafted as PHP code, results in a PHP file on disk whose contents (derived from the table name) are executable. When that file is subsequently requested through the web server, PHP executes the embedded code. Execution occurs in the context of the web server user (e.g., www-data, apache, nginx), not as a privileged system user, but this is typically sufficient to pivot within the application environment.

No public proof-of-concept, Nuclei template, or exploit code has been identified for this CVE. The attack chain described here is derived strictly from the NVD description and the vulnerability class (BOM-based filter bypass leading to code injection).

Exploitation Scenarios

The following chain is inferred from the NVD description and the CWE-94 class. No public PoC is available; specific payload strings and exact BOM-handling code paths are not described in the available intelligence and are therefore not fabricated below.

1. Reconnaissance and target identification. An adversary identifies a host running Adminer (typically exposed on a web port, often at a well-known path such as a single adminer PHP file). Presence can be confirmed via Shodan using the dorks in the metadata section or by directly requesting the Adminer login page. The attacker must establish that the SQLite driver is in use, since the flaw is specifically described for SQLite users.

2. Authentication. The attacker authenticates to Adminer with valid credentials to an SQLite database. The CVSS vector (PR:H) indicates high privileges are required — the attacker must already hold a working database login. This substantially narrows the realistic attacker set to insiders, users with leaked/shared credentials, or accounts obtained through separate compromise.

3. Filter bypass via BOM prefix. Once authenticated, the attacker submits a crafted SQL statement to the query interface. The statement is an ATTACH or VACUUM INTO command, prefixed with a UTF-8 byte-order mark. Adminer's validation logic does not strip or account for the BOM and therefore fails to classify the statement as restricted, permitting execution. SQLite accepts the BOM and executes the command normally.

4. Code placement and execution. Using the bypassed ATTACH, the attacker mounts a database file located at a path that the web server serves. Within that attached database, the attacker creates a table whose name contains PHP code. Because the table name is reflected into a file that PHP will parse and execute, requesting that file through the web server triggers execution of the embedded PHP as the web server user.

5. Post-exploitation impact. Successful execution grants the attacker arbitrary PHP execution in the web server context. From there, typical outcomes include reading application configuration and secrets, accessing the database independent of Adminer, establishing persistence, and pivoting to other services reachable from the host. The CVSS subscores (C:H/I:H/A:H) reflect full compromise of the confidentiality, integrity, and availability of the affected component.

The notable constraint is the need for a PHP-served, attacker-writable location reachable via ATTACH. Where Adminer is deployed in a locked-down, isolated environment without such a path, exploitation is significantly harder.

Impact Assessment

A successful attack yields remote code execution as the web server user on the Adminer host. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, giving a Base score of 7.2 (High).

• Attack Vector (AV:N — Network): The flaw is triggered over the network through the Adminer web interface, with no requirement for local access or physical proximity.
• Attack Complexity (AC:L — Low): No specialized conditions beyond the BOM-prefix technique and a reachable PHP-served path are described. The bypass itself is deterministic.
• Privileges Required (PR:H — High): The attacker must possess valid credentials to the SQLite database through Adminer, which caps the base score and limits mass-exploitation potential. This is the principal mitigating factor.
• User Interaction (UI:N — None): No victim action is required; the attacker drives the entire chain themselves.
• Scope (S:U — Unchanged): The impact is contained within the same security authority (the Adminer host/application), per the provided vector.
• Confidentiality/Integrity/Availability (C:H/I:H/A:H): All three are rated High. RCE typically enables exfiltration of all data the web server user can read, modification of files and database content, and denial of service through process termination or resource exhaustion.

Blast radius. Any internet- or intranet-exposed Adminer instance below version 6.1.1 that is configured against SQLite and permits authenticated access is at risk. Because Adminer frequently fronts production databases, compromise of the Adminer host can translate into compromise of the underlying data stores it manages, even though the flaw itself is scoped to the Adminer/SQLite context. Organizations that expose Adminer directly to the internet without network restrictions carry the greatest exposure.

Because no CISA KEV entry, EPSS score, or public exploit exists, current observed exploitation in the wild is not evidenced. However, the technique is low-complexity for someone who already holds valid SQLite credentials.

Detection Guidance

Sigma Rule

title: Adminer SQLite BOM-Prefixed ATTACH or VACUUM INTO Bypass (CVE-2026-109347)
id: 9a3f7c21-4b8e-4d6a-9c1f-7e2d5a8b6f04
status: experimental
description: Detects SQLite statements prefixed with a UTF-8 byte-order mark used to bypass Adminer ATTACH/VACUUM INTO restrictions
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109347
author: valtersit.com
date: 2026-01-01
logsource:
  product: webserver
  service: access_combined
detection:
  keywords_bom:
    - "\xEF\xBB\xBFATTACH"
    - "\xEF\xBB\xBFVACUUM INTO"
    - "%EF%BB%BFATTACH"
    - "%EF%BB%BFVACUUM%20INTO"
  keywords_sql:
    - "ATTACH DATABASE"
    - "VACUUM INTO"
  condition: keywords_bom
fields:
  - c-ip
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate UTF-8 BOM usage in uploaded text data
level: high

YARA Rule

rule CVE_2026_109347_Adminer_SQLite_BOM_Bypass
{
    meta:
        description = "Detects BOM-prefixed ATTACH or VACUUM INTO statements indicative of Adminer SQLite filter bypass (CVE-2026-109347)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109347"
        date = "2026-01-01"
        severity = "high"

    strings:
        $bom   = { EF BB BF }
        $attach = "ATTACH" ascii nocase
        $vacuum = "VACUUM INTO" ascii nocase
        $db     = "DATABASE" ascii nocase

    condition:
        $bom and ($attach or $vacuum)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109347 Adminer SQLite BOM-Prefixed ATTACH/VACUUM INTO Bypass Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"adminer"; nocase; http.request_body; content:"|EF BB BF|"; content:"ATTACH"; nocase; distance:0; http.request_body; content:"|EF BB BF|"; content:"VACUUM INTO"; nocase; distance:0; classtype:web-application-attack; reference:cve,CVE-2026-109347; sid:2026109347; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST" and
      url.path : "*adminer*" and
      http.request.body.content : "*\uFEFF*ATTACH*" ]
  [ network where http.request.method == "POST" and
      url.path : "*adminer*" and
      http.request.body.content : "*\uFEFF*VACUUM INTO*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval raw_lower = lower(_raw)
| where (match(raw_lower, "%ef%bb%bfattach") OR match(raw_lower, "%ef%bb%bfvacuum") OR match(_raw, "\xEF\xBB\xBF") AND (match(raw_lower,"attach") OR match(raw_lower,"vacuum into")))
| stats count min(_time) as first_seen max(_time) as last_seen by clientip, uri_path, useragent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,adminer,cve-2026-109347,">
  <rule id="2026109" level="12">
    <if_sid>31100</if_sid>
    <match>adminer</match>
    <regex>%EF%BB%BF(ATTACH|VACUUM)</regex>
    <description>CVE-2026-109347: Possible Adminer SQLite BOM-prefixed ATTACH/VACUUM INTO bypass exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,rce,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations (interim).

• Restrict network exposure of Adminer immediately: place it behind a VPN, an authenticated reverse proxy, or IP allow-listing. Do not expose Adminer directly to the internet.
• Enforce least privilege on Adminer database accounts. Because the flaw requires authenticated SQLite access (PR:H), removing or limiting SQLite logins reduces the exploitable population.
• Where SQLite administration is not required, disable the SQLite driver entirely to remove the attack surface described in this CVE.
• Ensure the web server and PHP process cannot write to PHP-served directories, breaking the "attach a database file at a PHP-served path" precondition.
• Monitor and alert on requests containing ATTACH, VACUUM INTO, or the UTF-8 BOM byte sequence in Adminer query parameters.

2) Patch/upgrade steps.

• Adminer 6.1.1 resolves this issue by closing the BOM-prefix bypass. Upgrade all Adminer installations to version 6.1.1 or later as soon as an official release is available and verified from the vendor's canonical distribution channel.
• Given patch confidence is 0/4 — no patch evidence from any tracked source — validate that the upgrade is an authentic vendor build and confirm the affected SQLite code paths are corrected before considering the system remediated. Do not assume a version banner alone proves the fix.
• Re-test the ATTACH/VACUUM INTO validation behavior post-upgrade with BOM-prefixed input as part of verification.

3) Long-term hardening.

• Adopt a policy of never exposing database administration tooling to untrusted networks; treat Adminer, phpMyAdmin, and similar utilities as privileged internal-only interfaces.
• Apply the principle of least privilege to all database management accounts, and rotate credentials that may have been shared or reused.
• Deploy runtime file-integrity monitoring on web-served directories to detect newly created PHP files (e.g., .php files whose names derive from database objects).
• Standardize an input-normalization stance across all query-handling code: explicitly strip or reject Unicode BOM and other zero-width characters before applying security filters, addressing the root semantic-gap class (CWE-94).
• Subscribe to Adminer release advisories and NVD updates for CVE-2026-109347 to act on a vendor patch the moment patch evidence becomes available.

References

• NVD — CVE-2026-109347: https://nvd.nist.gov/vuln/detail/CVE-2026-109347
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• Adminer project homepage and release history: https://www.adminer.org/
• CISA Known Exploited Vulnerabilities Catalog (check for CVE-2026-109347 status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or in-the-wild campaign data was identified for CVE-2026-109347 at the time of writing. CISA KEV status: not listed. EPSS: not yet scored by FIRST.org.