Security research · CVE-2026-96633
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
Published Oct 30, 2026 · catalog updated Oct 30, 2026 · AdminNeo SQLite Database-List Drop
Last checked Nov 7, 2026. A connected source was read within the last 7 days.
Open the advisory
Exploitation likelihood is not on this record for CVE-2026-96633. A missing EPSS score is not a low risk. Compare AdminNeo SQLite Database-List Drop with the linked advisory before you change production.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (AdminNeo SQLite Database-List Drop).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- EPSS is missing. A missing score is not a low risk.
- Severity
- High8.1
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- Not in the current FIRST EPSS dataset
- Remediation
- Advisory link
- Affected products
- Packagist adminneo-org/adminneo · composer adminneo-org
## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted values directly to . Originally reported by @slpoiuewalspoid-dotcom in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-6pg3-chwq-wgqc ## Impact An authenticated AdminNeo SQLite user with a valid CSRF token can submit an arbitrary relative file path in the database-list field. If the PHP process can delete that path, AdminNeo unlinks it even when the file is not a SQLite database. ## Root Cause The database-list page accepts selected database names from the POST body and calls : In SQLite mode, attaches an in-memory database and unlinks each submitted path directly: The same SQLite driver protects create and rename operations with , which requires a , , or extension: The drop path does not apply an equivalent extension check or bind the submitted path to a known listed SQLite database. ## POC ### 1. Start a complete AdminNeo application Build and start AdminNeo from the audited source using the official standalone Docker image shape. The validation image copies the audited source tree into and starts Nginx HTTP server. Log in through the SQLite entry point using a SQLite database path . ### 2. Prepare a writable target file Place a non-database file under a location writable by the AdminNeo PHP process. The validation used: The same directory also contained a SQLite database: ### 3. Submit the database-list drop request Use the authenticated session and live CSRF token, but submit the non-database path as the selected database: The request reaches and SQLite calls on the submitted non-database path. After the request, the was deleted. ## Suggested Fix Apply the same target validation used by SQLite create/rename before deleting database files. At minimum: - Reject paths
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Packagist adminneo-org/adminneo0 → 5.5.1
- composer adminneo-orgversion unspecified
How to fix CVE-2026-96633
Upgrade
CVE-2026-96633 lists a fix boundary at 5.5.1. Compare the installed build with that boundary before you change production.
Version check
Fixed in 5.5.1
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
Exploitation likelihood is not on this record for CVE-2026-96633. A missing EPSS score is not a low risk. Compare AdminNeo SQLite Database-List Drop with the linked advisory before you change production.
Which versions are affected?
Compare what you have installed with 0 → 5.5.1. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-73. EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Technology hubs
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 30, 2026 · GitHub Advisory Database
Detected
## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted values directly to . Originally reported by @slpoiuewalspoid-dotcom in Adminer: https://github.com/vrana/adminer/sec
Oct 30, 2026 · GitHub Advisory Database
Fix available
adminneo-org/adminneo fixed in 5.5.1
Oct 30, 2026 · GitHub Advisory Database
Fix available
adminneo-org/adminneo fixed in 5.5.1
Oct 30, 2026 · GitHub Advisory Database
Updated
## Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted values directly to . Originally reported by @slpoiuewalspoid-dotcom in Adminer: https://github.com/vrana/adminer/sec
Sources
- CVE.orgVulnerability recordCVE-2026-96633
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-6vfx-w7q3-42gq
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-96633
AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db[] values directly to unlink(). Originally reported by @slpoiuewalspoid-dotcom in Adminer: https://github.com/vrana/adminer/s
advisories.gitlab.com - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-6vfx-w7q3-42gq
AdminNeo SQLite Database-List Drop Arbitrary File Deletion
osv.dev
References
Freshness
Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- GitLab Advisory DatabaseNov 5, 2026
- GitHub Advisory DatabaseNov 2, 2026
- OpenSSF OSV / OSV ScannerNov 2, 2026
- CVE.orgOct 31, 2026