CVE-2026-34967

Executive Summary

CVE-2026-34967 is an arbitrary file write vulnerability affecting Adminer versions 5.3.0 through 5.4.2 when the third-party sql-log plugin is enabled. An authenticated user can exploit a path traversal flaw in the ns parameter of plugins/sql-log.php to write attacker-controlled .sql files to any writable directory on the host operating system. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, and is classified under CWE-73 (External Control of File Name or Path).

The attack surface is limited to authenticated users, and the affected deployment must have the optional sql-log plugin enabled. However, Adminer instances exposed to the internet with default or weak credentials present a realistic exploitation pathway. As of the writing of this report, no patch is available from any tracked source, no public exploit code exists, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The sql-log plugin should be disabled or the affected Adminer version replaced immediately.

Technical Analysis

Adminer is a single-file database management tool written in PHP that provides a lightweight alternative to phpMyAdmin. The product is deployed by system administrators to manage MySQL, PostgreSQL, SQLite, and other database engines via a web browser. The vulnerability described in CVE-2026-34967 exists within the third-party sql-log plugin, which is designed to log SQL queries executed by administrators for auditing and troubleshooting purposes.

The flaw resides in how the ns parameter within plugins/sql-log.php is handled. The application constructs a file path for writing SQL log output without adequately validating or sanitizing the ns value for path traversal sequences. Specifically, an authenticated user can supply a value containing directory traversal sequences (e.g., ../) in the ns parameter. The application then uses this attacker-controlled value to build a filesystem path, ultimately writing attacker-selected content (the logged SQL query) as a .sql file to an arbitrary location.

The vulnerability class is CWE-73, External Control of File Name or Path. This class of vulnerability arises when a product uses user-supplied input to construct a file path without validating that the resulting path stays within an expected directory. In this case, a malicious authenticated user can escape the intended log directory and write .sql files anywhere the web server process has write permissions.

The written file content is described as "attacker-controlled content," meaning the user can influence what gets stored. In the context of the sql-log plugin, the content is generally the SQL query being logged. Since an authenticated user can issue arbitrary SQL statements through Adminer's primary interface, they can inject content that will be written verbatim to the .sql file. This creates a scenario where the attacker controls both the destination path and, to a large degree, the file contents.

It is worth noting that the file extension is fixed to .sql — the attacker cannot write PHP, HTML, or other executable file types directly. This mitigates trivial remote code execution via web shell upload, as PHP interpreters do not execute .sql files by default. However, the impact should not be underestimated: writing files to arbitrary directories can facilitate other attacks such as cron job manipulation (if .sql files are somehow processed), log poisoning, database credential theft via writing to accessible locations, or denial-of-service by overwriting critical files — though overwriting non-.sql files is not possible given the fixed extension.

The disclosed affected range is Adminer versions 5.3.0 through 5.4.2. Versions prior to 5.3.0 and the current development tree beyond 5.4.2 are not stated as affected in the NVD description, but the absence of a patched version from any tracked source suggests the vulnerability remains open in all known released versions within the range.

Exploitation Scenarios

No public exploit code or PoC is available for CVE-2026-34967. The following attack chain is inferred from the vulnerability class and the NVD description alone. No specific code patterns, frameworks, or tooling are implied.

Step 1 — Reconnaissance / Target Identification: An attacker scans the internet or an internal network for exposed Adminer instances. Adminer is commonly identified by its distinctive login page title "Adminer" or by its single-file adminer.php layout. Shodan queries such as http.title:"Adminer" or HTTP response fingerprinting can reveal these instances. Once a target is found, the attacker checks whether the sql-log plugin is enabled — this may be visible through Adminer's plugin listing or inferred from the presence of plugins/sql-log.php in the web root.

Step 2 — Authentication: The attacker must first authenticate to the Adminer instance. This requires valid database credentials. Common vectors include default or weak credentials, leaked administrative passwords, or credential stuffing against internet-facing Adminer instances. The CVSS vector confirms the attack requires low-privilege access (PR:L) and no user interaction (UI:N), reinforcing that the attacker is a legitimate but low-privileged authenticated user (or has compromised such an account).

Step 3 — Triggering the Vulnerability: After authentication, the attacker crafts an HTTP request to plugins/sql-log.php that includes a malicious ns parameter value containing path traversal sequences. For example, supplying a value such as ../../../../tmp/evil in the ns parameter would cause the plugin to resolve the log file path to /tmp/evil.sql on a typical Unix host. Simultaneously, the attacker initiates a SQL query through Adminer whose content will be written to that file. Because the attacker controls the SQL query content, the resulting .sql file contains attacker-chosen data.

Step 4 — Post-Exploitation Impact: Once the attacker has written an arbitrary .sql file to a writable directory, the impact depends on the target environment. Possible outcomes include:

• Data contamination / SQL injection into automated jobs: If the written .sql file lands in a directory scanned by database automation tools (e.g., a cron job that imports .sql files into a database), the attacker can inject arbitrary SQL statements to modify data, exfiltrate data, or drop privileges.
• Log poisoning: The attacker may write to application or system log directories to conceal their activities or mislead incident responders.
• File-based privilege escalation: If the web server runs with elevated privileges, the attacker may write into sensitive directories, though the fixed .sql extension limits this.
• Denial of Service: Writing large files to disk can exhaust storage and disrupt legitimate services.

The attack requires no social engineering and no user interaction. The network vector (AV:N) and low attack complexity (AC:L) make this moderately easy to exploit for any authenticated user, earning it a CVSS base score of 5.4 with low confidentiality, integrity, and availability impact.

Impact Assessment

Business Impact: CVE-2026-34967 represents an integrity and availability risk for organizations running Adminer with the sql-log plugin. The confidentiality impact is rated Low (C:N in the CVSS vector), indicating that the vulnerability does not directly enable data exfiltration through this specific flaw. However, the integrity impact is Low (I:L) and availability impact is Low (A:L), reflecting that while the attacker can write files, the fixed .sql extension constrains the severity.

The most significant business risks include:

• Database integrity: If an attacker writes .sql files that are automatically executed by cron jobs or database import scripts, they could modify, delete, or exfiltrate sensitive data.
• System availability: Disk exhaustion via large file writes can disrupt both the Adminer service and co-located services.
• Regulatory/compliance risk: For organizations subject to data protection regulations (e.g., GDPR, HIPAA), an integrity breach affecting databases could constitute a reportable incident.

Affected Systems: All Adminer installations running versions 5.3.0 through 5.4.2 with the sql-log plugin enabled are vulnerable. The plugin must be explicitly configured; default Adminer installations may not load it. However, any organization that enabled the plugin for SQL auditing is at risk. The vulnerability affects any operating system where PHP's file permissions allow the web server user to write to target directories.

Blast Radius: The attack is confined to authenticated users of the Adminer instance. If the instance is internet-exposed with weak credentials, the blast radius expands to any external attacker who can compromise or guess an account. Internal threats — a malicious insider or a compromised low-privilege database account — can also exploit this flaw. The PR:L component of the CVSS vector confirms that even low-privileged authenticated users can trigger the vulnerability, widening the pool of potential attackers.

EPSS: FIRST.org has not yet assigned an EPSS score to this CVE. No active exploitation in the wild has been reported, and no CISA KEV inclusion exists at the time of writing.

Detection Guidance

The following detection rules are designed to catch exploitation attempts against CVE-2026-34967. They focus on abnormal ns parameter values in requests to plugins/sql-log.php, path traversal patterns, and anomalous file write behavior. These rules are realistic and should be tuned to the specific environment.

Sigma Rule

title: Adminer sql-log Plugin Path Traversal File Write
id: a1b2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts in the ns parameter of Adminer's sql-log plugin, indicating CVE-2026-34967 exploitation.
author: valtersit.com Threat Intelligence
logsource:
  category: webserver
  product: apache
  service: access
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains:
      - 'plugins/sql-log.php'
      - 'ns='
  condition: selection and path_traversal
  filter:
    cs-uri-query|contains:
      - 'ns=dbname'
      - 'ns=sqllog'
  path_traversal:
    cs-uri-query|contains:
      - '..%2f'
      - '..%252f'
      - '%2e%2e%2f'
      - '/../'
      - '%2e%2e%5c'
      - '..%5c'
      - '.../'
  timeframe: 5m
level: high
falsepositives:
  - Legitimate log directory names containing dots or slashes (rare)
tags:
  - attack.t1068
  - cve.2026.34967
  - cwe.73

YARA Rule

rule Adminer_SQL_Log_Path_Traversal_CVE_2026_34967
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects path traversal payloads targeting Adminer sql-log plugin ns parameter"
        cve = "CVE-2026-34967"
        date = "2026-01-01"
        score = 75
    strings:
        $php_endpoint = "plugins/sql-log.php" ascii nocase
        $ns_param = "ns=" ascii nocase
        $pt_traversal1 = "..%2f" ascii nocase
        $pt_traversal2 = "..%252f" ascii nocase
        $pt_traversal3 = "%2e%2e%2f" ascii nocase
        $pt_traversal4 = "/../" ascii nocase
        $pt_traversal5 = "..%5c" ascii nocase
        $pt_traversal6 = "....//" ascii nocase
        $sql_ext = ".sql" ascii nocase
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Adminer sql-log plugin path traversal file write attempt (CVE-2026-34967)";
    flow:established,to_server;
    http.uri;
    content:"plugins/sql-log.php";
    content:"ns=";
    content:"..%2f"; sid:2026349671; rev:1; classtype:attempted-admin;
    reference:cve,2026-34967;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-34967;
    metadata:created_at 2026_01_01, updated_at 2026_01_01;
)

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Adminer sql-log plugin encoded path traversal (CVE-2026-34967)";
    flow:established,to_server;
    http.uri;
    content:"plugins/sql-log.php";
    content:"ns=";
    pcre:"/ns=[^&]*(?:\.\.|%2e%2e|\.%2e|%2e\.)(?:%2f|\/|%5c|\\\\)/i";
    sid:2026349672; rev:1; classtype:attempted-admin;
    reference:cve,2026-34967;
    metadata:created_at 2026_01_01, updated_at 2026_01_01;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.action == "connection_attempted" and destination.port == 80]
  [http where http.request.method == "GET" and
     wildcard(http.request.uri.path, "*/plugins/sql-log.php*") and
     wildcard(http.request.uri.query, "*ns=*") and
     (wildcard(http.request.uri.query, "*..%2f*") or
      wildcard(http.request.uri.query, "*..%252f*") or
      wildcard(http.request.uri.query, "*%2e%2e%2f*") or
      wildcard(http.request.uri.query, "*/../*") or
      wildcard(http.request.uri.query, "*..%5c*"))]
  [file where event.action == "write" and file.extension == "sql" and
     file.path != "/var/log/sql/*.sql"]

Splunk SPL Query

index=web sourcetype=access_combined
| spath input=uri_query output=ns_value ns
| where like(uri_path, "%plugins/sql-log.php%") AND like(ns_value, "%..%")
| eval traversal_indicators = mvfind(
      split(ns_value, ""),
      "%(%2e%2e%2f)|(\.\./)|(\.\.\\)|(\.\.%2f)"
  )
| where isnotnull(traversal_indicators)
| table _time, src_ip, src_port, dest_ip, dest_port, uri_path, uri_query, ns_value, http_user_agent
| sort - _time
| eval threat = "CVE-2026-34967 Adminer sql-log path traversal attempt"
| lookup cve_enrichment cve_id AS cve_id OUTPUT cve_score, cve_severity
| where cve_id="CVE-2026-34967"

Wazuh OSSEC Rule

<group name="web, adminer, cve_2026_34967,">
  <rule id="349671" level="12">
    <decoded_as>web</decoded_as>
    <description>Adminer sql-log plugin path traversal attempt detected (CVE-2026-34967)</description>
    <field name="url">plugins/sql-log.php</field>
    <regex>ns=.*(\.\.%2f|%2e%2e%2f|\.\./|\.\.\\)</regex>
    <group>attack.t1068,cwe.73,</group>
    <mitre>
      <id>T1068</id>
    </mitre>
    <info type="cve">CVE-2026-34967</info>
    <options>no_full_log</options>
    <alert>
      <level>12</level>
      <description>Adminer sql-log plugin path traversal attempt detected (CVE-2026-34967)</description>
    </alert>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

As of the writing of this report, no vendor patch, patched version, or security advisory addressing CVE-2026-34967 has been identified from any tracked source. The vendor has not released a fix, and no third-party mitigation patch is publicly available. The issue remains open in the affected version range (5.3.0 through 5.4.2).

1) Immediate Mitigations (no patch available)

• Disable the sql-log plugin immediately. If the plugin is not active, the vulnerable code path in plugins/sql-log.php is unreachable. Check Adminer configuration files (typically plugins/ directory and adminer.php configuration) and remove any reference to sql-log.php.
• Restrict access to Adminer. Place Adminer behind a VPN, jump host, or IP allowlist so only authorized personnel can reach the login page. Combine with multi-factor authentication if available.
• Enforce strong authentication. Change all database credentials used with Adminer to strong, unique values. Disable or remove any default or test accounts.
• Apply filesystem permissions. Ensure the web server user has write access only to the directories it strictly requires (e.g., the Adminer installation directory and temporary session storage). Remove write permissions from system directories (/tmp, /var/www siblings, /etc, etc.).
• Monitor the vulnerable file. Place filesystem watchdogs or audit rules on known writable directories to alert on new .sql files outside expected log paths.

2) Patch / Upgrade Steps

• No patched version is available. Continue to monitor the Adminer project’s official repository and security advisories for an updated release affecting this CVE.
• Consider a temporary fork or internal patch. If the organization has the capacity, an internal patch can neutralize the path traversal by adding robust path validation in the ns parameter handling — e.g., rejecting any value containing .., enforcing the resolved path to remain within a configurable log root, and validating basename characters. This is a temporary measure until an official patch is released.
• If feasible, downgrade to a version prior to 5.3.0 if it does not include the vulnerable plugin logic — but verify that the older version does not inherit the same flaw, as the advisory only confirms the 5.3.0–5.4.2 range.

3) Long-Term Hardening

• Eliminate Adminer from production entirely. Adminer is a development and administrative tool; remove it from internet-facing and production environments. Access databases through managed services or hardened, self-hosted alternatives.
• Adopt a web application firewall (WAF). Deploy a WAF with virtual patching to block plugins/sql-log.php requests containing path traversal patterns.
• Implement a change management process requiring security review before any third-party plugin is enabled in production.
• Establish a baseline of file write activity on web servers and database hosts, enabling rapid detection of anomalies via the Sigma/YARA/Suricata rules above.
• Track this CVE in the organization’s vulnerability management pipeline. Revisit the patch status when new vendor commits or security advisories are published.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-34967 — Official National Vulnerability Database record containing the CVE description, CVSS v3.1 vector, and CWE classification.
2. Adminer Official Project: https://www.adminer.org/ — The official Adminer project page; monitor for future release notes and security advisories related to this CVE.
3. CWE-73 Detail: https://cwe.mitre.org/data/definitions/73.html — MITRE CWE entry for External Control of File Name or Path, the flaw class governing this vulnerability.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — As of the report date, CVE-2026-34967 is not listed in the KEV catalog. Recheck periodically for updates.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known threat actor campaigns, exploit-kit integration, or in-the-wild exploitation of CVE-2026-34967 has been reported at the time of this writing. The EPSS score is not yet available, and no exploit code has been publicly released. This report should be updated if the vulnerability status changes.