AdminNeo SQLite Database-List Drop Arbitrary File Deletion

High · CVSS 8.1 (GHSA) · fetched 2026-10-30

## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted `db[]` values directly to `unlink()`.

Remediation

Upgrade adminneo-org/adminneo to 5.5.1 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-30T20:20:13-04:00 · https://github.com/advisories/GHSA-6vfx-w7q3-42gq

← All threats