AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)
High · CVSS 7.2 (GHSA) · fetched 2026-10-30
## Summary Adminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands.
Remediation
Upgrade adminneo-org/adminneo to 5.5.1 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-30T20:20:13-04:00 · https://github.com/advisories/GHSA-q5mp-gfjf-cf2j