{"items":[{"id":"NVI-00004498","kind":"vulnerability","title":"AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-q5mp-gfjf-cf2j","CVE-2026-96630"],"plain_summary":"GitHub lists this reviewed advisory for adminneo-org/adminneo. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-b304e165641850480e742b60c1ba6cba"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 5.5.1 for adminneo-org/adminneo. Confirm the publisher’s latest guidance.","source_ids":["sr-6868a94172b9407dff97d132d4459742"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T22:51:38.000Z","value":"7.2 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-b304e165641850480e742b60c1ba6cba"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b304e165641850480e742b60c1ba6cba","url":"https://github.com/advisories/GHSA-q5mp-gfjf-cf2j","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-q5mp-gfjf-cf2j","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-6868a94172b9407dff97d132d4459742","url":"https://github.com/advisories/GHSA-q5mp-gfjf-cf2j","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-q5mp-gfjf-cf2j","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.998Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b304e165641850480e742b60c1ba6cba"],"technology":"adminneo-org/adminneo","known_exclusions":[],"conditions_summary":"## Summary\nAdminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands.\n\nOriginally reported in Adminer: GHSA-q4f2-39gr-45jh\n\n## Root Cause\nsql.inc.php, line 146:\n\n```php\nif (DIALECT == \"sqlite\" && preg_match(\"~^$space*+ATTACH\\\\b~i\", $q, $match)) {\n    // blocked\n}\n```\n\nOnly `ATTACH` is in the blocklist. `VACUUM INTO` (available since SQLite 3.27.0) writes the entire database to a new file at an arbitrary path with an arbitrary extension. It is not checked.\n\n## Steps To Reproduce\n\n### 1.  Login to SQLite\n1. Open AdminNeo and select driver: **SQLite**\n2. Login and create a new database (e.g., `stage.db`)\n\n### 2. Inject PHP code and write the shell\n\nNavigate to **SQL command** and execute:\n\n```sql\nCREATE TABLE \"\" (i int);\nVACUUM INTO '/var/www/html/shell.php';\n```\n\nThe SQLite file is written to `/var/www/html/shell.","public_affected_ranges":["< 5.5.1"]},{"certainty":"source_listed","source_ids":["sr-6868a94172b9407dff97d132d4459742"],"technology":"adminneo-org/adminneo","known_exclusions":[],"conditions_summary":"## Summary\nAdminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands.\n\nOriginally reported in Adminer: GHSA-q4f2-39gr-45jh\n\n## Root Cause\nsql.inc.php, line 146:\n\n```php\nif (DIALECT == \"sqlite\" && preg_match(\"~^$space*+ATTACH\\\\b~i\", $q, $match)) {\n    // blocked\n}\n```\n\nOnly `ATTACH` is in the blocklist. `VACUUM INTO` (available since SQLite 3.27.0) writes the entire database to a new file at an arbitrary path with an arbitrary extension. It is not checked.\n\n## Steps To Reproduce\n\n### 1.  Login to SQLite\n1. Open AdminNeo and select driver: **SQLite**\n2. Login and create a new database (e.g., `stage.db`)\n\n### 2. Inject PHP code and write the shell\n\nNavigate to **SQL command** and execute:\n\n```sql\nCREATE TABLE \"\" (i int);\nVACUUM INTO '/var/www/html/shell.php';\n```\n\nThe SQLite file is written to `/var/www/html/shell.","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 5.5.1"]}],"null_published_at":"2026-10-31T22:13:31.283Z","source_updated_at":"2026-10-30T22:51:38.000Z","source_disclosed_at":"2026-10-30T22:51:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:42:30.998Z"}],"next_cursor":null,"snapshot_revision":"42594"}