Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability

July 29th, 2026
ZDI-26-478 ZDI-CAN-28201

CVE ID

CVE-2026-15686

CVSS Score

7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

Adminer

Affected Products

Adminer

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adminer. Authentication is required to exploit this vulnerability.

The specific flaw exists within the multi_query method. The issue results from an incorrect check of a function return value. An attacker can leverage this vulnerability to execute code in the context of the web server.

Additional Details

Adminer has issued an update to correct this vulnerability. More details can be found at:
https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7#event-826206

Disclosure Timeline

  • 2026-03-06 - Vulnerability reported to vendor
  • 2026-07-29 - Coordinated public release of advisory
  • 2026-07-29 - Advisory Updated

Credit

0daystolive (Sorcery Ltd)

Back to Advisories