AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE
Medium · fetched 2026-10-30
### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to create PHP files through SQLite ATTACH statements, achieving remote code execution. The patch introduced a regex filter to block ATTACH queries, but this filter is vulnerable to catastrophic backtracking.
Remediation
Upgrade adminneo-org/adminneo to 5.5.1 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-30T20:20:13-04:00 · https://github.com/advisories/GHSA-p96f-p2p2-2g3h