CVE-2026-34968

Executive Summary

CVE-2026-34968 is an arbitrary file deletion vulnerability affecting Adminer versions prior to 5.4.3, specifically exposed when the application operates in SQLite database mode. The flaw resides in the database-list drop action, which fails to validate file extensions before performing file deletion operations. An authenticated attacker with low-privilege credentials can submit arbitrary relative file paths through the db[] parameter, allowing deletion of any files on the server that are writable by the PHP process. The vulnerability carries a CVSS score of 8.1 (High) with a network attack vector and no user interaction required, though it does require authentication (privilege level Low). The impact is high for both integrity and availability, as critical application files, configuration files, or dependent data stores can be destroyed.

Technical Analysis

Adminer is a lightweight, single-file database management tool written in PHP that supports multiple database backends including MySQL, PostgreSQL, and SQLite. When configured in SQLite mode, the administrative interface provides a web-based mechanism to list, create, and delete databases hosted on the underlying filesystem.

The vulnerability is rooted in the database-list drop action, a user-interface component that allows an authenticated user to remove a database. The application constructs a file removal operation based on the db[] HTTP request parameter, which identifies which database(s) to act upon. The flaw is that this parameter is not constrained by a file extension whitelist or blacklist before being passed to the file deletion routine.

In SQLite mode, a "database" is simply a .sqlite file on disk, and Adminer must derive the file path from the database name. The vulnerable code path fails to enforce that the user-supplied value in db[] retains the expected .sqlite (or equivalent) extension. Consequently, an attacker can substitute a relative file path such as ../../important.conf or config.php into the db[] parameter. When the deletion routine executes, it resolves the relative path against the current working directory of the PHP process (typically the web root) and removes the targeted file, regardless of whether it has the .sqlite extension. No file type or extension validation is performed, creating a classic path traversal (CWE-22) scenario combined with an unvalidated delete operation.

The attack requires authentication — the attacker must hold valid credentials to the Adminer interface, which is assumed to have the tools' default privilege level (any user capable of selecting SQLite mode and listing databases). The network vector is remote, and no user interaction is required, making this an attractive post-authentication foothold for an attacker who has gained low-privilege access to the adminer portal.

While the NVD description does not specify which exact filename validation function is absent, the vulnerability class is clear: path traversal leading to arbitrary file deletion. Because the deletion target is not restricted to a controlled directory or extension set, an authenticated attacker can escalate their impact by removing files critical to the web application, such as configuration files, .htaccess rules, uploaded assets, or other database files, thereby disrupting availability and potentially degrading security controls.

Exploitation Scenarios

No public PoC or exploit code is currently available for CVE-2026-34968; the attack chain described below is inferred strictly from the vulnerability class and the official NVD description.

Step 1 — Reconnaissance / Target Identification An attacker identifies a publicly accessible Adminer instance by scanning for HTTP services that respond with Adminer-specific content. Shodan dorks such as http.title:"Adminer" or html:"Adminer 4.8.1" can reveal exposed instances. Alternatively, directory brute-forcing may discover /adminer.php, /adminer, or similar endpoints. The attacker must then authenticate using default, weak, or previously compromised credentials.

Step 2 — Triggering the Flaw Once authenticated, the attacker navigates to the SQLite database view where database listing is displayed. The application renders a list of databases with an associated "drop" (delete) action, typically in the form of a form submission that includes a db[] parameter array. The attacker intercepts this request using a web proxy or via browser developer tools and modifies the db[] parameter value to a relative file path outside the intended database directory — for example, ../../config.php or ../../.env. The attacker submits the form, causing the application to pass the unsanitized value to the file deletion routine.

Step 3 — Payload / Execution Method At the vulnerability-class level, the payload is a path traversal sequence (../) combined with an arbitrary filename. Because the drop action does not validate the file extension, the deletion routine accepts the modified db[] value and resolves it relative to the PHP working directory. The operating system performs the unlink operation on the resolved path. The attacker repeats this process with multiple paths (db[]=../../file1, db[]=../../file2) in a single request to delete multiple files, maximizing impact.

Step 4 — Post-Exploitation Impact After deletion of critical files (e.g., application configuration, database connection settings, upload directories, or other Adminer-supported databases), the target web application may fail to boot, lose authentication state, or exhibit degraded functionality. The attacker gains:

• Availability impact: Denial of service due to removed application files.
• Integrity impact: Destruction of configuration data, possibly weakening other security controls.
• In scenarios where the config.php file of an application is deleted, some PHP applications may respond to subsequent requests by entering an installation wizard, potentially allowing the attacker to then upload malicious files or gain greater control under specific conditions — though this escalation path is environment-specific and not guaranteed by the CVE description alone.

Impact Assessment

CVE-2026-34968 is rated High severity with a CVSS base score of 8.1. The vector breakdown is: AV:N (network-exploitable), AC:L (no special conditions), PR:L (requires low-privileged authentication), UI:N (no user interaction), S:U (scope unchanged), C:N (no confidentiality loss), I:H (high integrity loss), A:H (high availability loss).

The primary business impact is data destruction. An authenticated attacker can remove configuration files, custom plugins, other database files, or application source files, causing:

• System downtime: Loss of availability as the application fails to load or crashes on the next request.
• Loss of forensic evidence: Deletion of logs or audit trails may hinder incident investigation.
• Precursor to further compromise: Removal of access control files (e.g., .htaccess or web application firewalls) may weaken perimeter defenses.
• Regulatory impact: If database files containing sensitive information are deleted, the organization may face compliance breaches (GDPR, HIPAA) due to data loss.

The blast radius is limited to the server where Adminer is running, but the PHP process usually runs with privileges sufficient to delete files in the web root and sometimes beyond (e.g., adjacent writeable directories within the same user context). The attack does not require a high-privileged account — only a standard Adminer user account — making this a viable post-authentication privilege-impact escalation vector.

Detection Guidance

The following detection rules target the specific request pattern associated with path traversal in the db[] parameter during a drop action.

Sigma Rule

title: Adminer SQLite Arbitrary File Deletion - Path Traversal in db[] Parameter
status: experimental
description: Detects HTTP POST requests to Adminer with a path traversal sequence in the db[] parameter targeting the drop action.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-34968
tags:
    - attack.t1190
    - cve.2026-34968
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url|contains: 
            - 'script=db'
            - 'db='
            - 'drop'
        http.user_agent|contains|all:
            - 'Mozilla'
            - 'Chrome'
    filter_adminer_sqlite:
        http.url|contains:
            - 'sqlite'
    condition: selection and filter_adminer_sqlite
    falsepositives:
        - Legitimate database deletion tasks where a user manually types a full relative path in the db[] parameter (unlikely with standard UI).
level: high

YARA Rule

rule Adminer_SQLite_File_Deletion_Attempt
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects HTTP request bodies containing traversal sequence in db[] parameter for Adminer drop action"
        cve = "CVE-2026-34968"
        date = "2026-01-01"
    strings:
        $traversal = /db\[\]\s*=\s*\.\.\/\.\.\//
        $drop_action = /\baction=(drop|delete)\b/i
        $adminer_sqlite = /sqlite/i
    condition:
        uint16(0) == 0x0a0d or all of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"Adminer SQLite Arbitrary File Deletion - Traversal in db[]"; flow:established,to_server; content:"POST"; http_method; content:"script=db"; http_uri; content:"db[]="; http_uri; pcre:"/db\[\]=[^&]*\.\.\//Ui"; reference:cve,2026-34968; classtype:attempted-admin; sid:10034968; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [http where request.method == "POST" and request.body : "*db%5B%5D=*.%2F*" and request.body : "*script=db*"]
  [file where event.action == "deletion" and process.name : "php*"]

Splunk SPL Query

index=web sourcetype="access_combined" method=POST
| regex "url=.*script=db.*db%5B%5D=.*\.\.\/"
| regex "url=.*script=db.*db\[\]=.*\.\.\/"
| stat count by src_ip, uri, http_user_agent

Wazuh OSSEC Rule

<rule id="245194" level="12">
    <decoded>event.outcome: success</decoded>
    <field name="url" type="pcre2">\.\./\.\./.*(script=db|db\[)=</field>
    <description>CVE-2026-34968 - Adminer SQLite arbitrary file deletion (path traversal in db[])</description>
    <group>web_application_attack,</group>
    <mitre>
        <id>T1190</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vulnerability is confirmed in Adminer versions before 5.4.3, and the vendor has not yet released a fix as of the writing of this report. No vendor advisory or patch commit has been identified.

Immediate Mitigations:

1. Upgrade to Adminer 5.4.3 — The only reliable mitigation is to upgrade to version 5.4.3 or later once the vendor ships the fix. Monitor the Adminer release page (adminer.org) for the patched version.
2. Disable SQLite mode — If the affected environment does not genuinely require SQLite administration through the web interface, prevent access to the SQLite mode by reconfiguring Adminer to only expose supported database backends or by removing the SQLite driver files if feasible.
3. Restrict network access — Immediately place the Adminer interface behind a VPN, firewall, or IP allowlist to limit external network access, effectively reducing the attack surface to internal users only.
4. Strengthen authentication — Enforce multi-factor authentication (MFA) and strong password policies for all Adminer accounts, as the attack requires authentication with low-privilege credentials.
5. Service account hardening — Ensure the PHP process runs under a least-privilege system account with write access limited to the absolute minimum required directories (typically the web root and temporary directories). Remove write permissions from directories containing configuration files, application source code, and OS-level configuration.

Patch/Upgrade Steps:

1. Check the current Adminer version (select version() on some setup pages or inspect the Adminer.php version string).
2. Download Adminer 5.4.3 or later from the official Adminer website as soon as released.
3. Replace the existing Adminer file with the upgraded version and verify that the upgrade does not break existing connection configurations.
4. Re-test SQLite database listing and deletion functionality after upgrade to confirm the extension validation is enforced.

Long-Term Hardening:

• Remove or pivot Adminer from production — Adminer is a powerful tool that is rarely needed in production. Disable it or migrate to a secure, hosted database administration solution with built-in authorization and audit logging.
• Web Application Firewall (WAF) rules — Deploy WAF rules to block HTTP requests containing traversal sequences (../) in any parameter, and specifically in the db[] parameter, regardless of application.
• Network segmentation — Place database administration tools in a separate management VLAN with strict access controls and comprehensive logging.
• Regular security reviews — Audit Adminer installations quarterly for exposure, authentication strength, and access logs.
• Application-layer validation — Until a patch is available, implement an input validation wrapper or reverse proxy that rejects any request to Adminer containing ../ or ..%2F in query parameters.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-34968
2. Adminer Official Site: https://www.adminer.org/
3. CWE-22 (Path Traversal): https://cwe.mitre.org/data/definitions/22.html
4. CISA Known Exploited Vulnerabilities Catalog (No entry for this CVE at this time): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: As of this report, there is no evidence of exploitation in the wild, no public PoC, and no known threat actor campaigns targeting this vulnerability. The CVE is not listed in the CISA KEV catalog. However, given the high CVSS score and the ubiquity of exposed Adminer instances, it is reasonable to expect that weaponization will occur once a patch is reverse-engineered or the flaw is discovered independently. Organizations should treat the vulnerability as a high-priority risk even in the absence of active exploits.