AdminNeo: version-cache array injection causes persistent denial of service
High · CVSS 7.5 (GHSA) · fetched 2026-10-30
### Summary AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours.
Remediation
Upgrade adminneo-org/adminneo to 5.5.0 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-30T16:20:16-04:00 · https://github.com/advisories/GHSA-jm85-8cpp-9cjc