ZDF
Sign inSign up

Vulnerabilities

Security research · CVE-2026-96634

AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · AdminNeo SQLite: multi_query Incorrect

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-96634. A missing EPSS score is not a low risk. Compare AdminNeo SQLite: multi_query Incorrect with the linked advisory before you change production.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (AdminNeo SQLite: multi_query Incorrect).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
  • EPSS is missing. A missing score is not a low risk.
Severity
Unknown—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
Not in the current FIRST EPSS dataset
Remediation
Advisory link
Affected products
Packagist adminneo-org/adminneo · composer adminneo-org

### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to create PHP files through SQLite ATTACH statements, achieving remote code execution. The patch introduced a regex filter to block ATTACH queries, but this filter is vulnerable to catastrophic backtracking. Originally reported by @zdi-disclosures in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-3582-q6xq-5vf7 ### Analysis **[Source]** sql.inc.php :: SQL import handler:47 > User uploads a malicious SQL file through the import form. The file content is read into the variable without any initial sanitization. **[Transform]** sql.inc.php :: SQL import handler:87 > The uploaded SQL content is processed in a loop that splits it into individual queries. Each query is extracted for processing. **[Context]** sql.inc.php :: SQL import handler:65 > Definition of the regex pattern used in the ATTACH filter. The possessive quantifier combined with SQLite comment patterns ( ) creates the catastrophic backtracking vulnerability when many comment lines are processed. **[Transform]** sql.inc.php :: SQL import handler:146 > The ATTACH query filter check. When the regex encounters 350,000 SQLite comment lines ( ), it triggers catastrophic backtracking. The possessive quantifier causes exponential backtracking, eventually hitting PHP's backtracking limit and causing to return instead of or , bypassing the security filter. **[Sink]** sql.inc.php :: SQL import handler:162 > When the ATTACH filter is bypassed due to the returning , the malicious SQL query containing the ATTACH statement is executed. This allows the attacker to create a file with embedded PHP code, achieving remote code execution when the file is accessed via HTTP. The root cause is that PHP's function returns when the backtracking limit is exceeded, b

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Packagist adminneo-org/adminneo0 → 5.5.1
  • composer adminneo-orgversion unspecified

How to fix CVE-2026-96634

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for CVE-2026-96634. A missing EPSS score is not a low risk. Compare AdminNeo SQLite: multi_query Incorrect with the linked advisory before you change production.

Which versions are affected?

Compare what you have installed with 0 → 5.5.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-74: Injection. EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to create PHP files through SQLite ATTACH statements, achieving remote code execution. The patch introduced a regex filter to block ATTACH queries

  2. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    adminneo-org/adminneo fixed in 5.5.1

  3. Oct 30, 2026 · GitHub Advisory Database

    Fix available

    adminneo-org/adminneo fixed in 5.5.1

  4. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ### Summary This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to create PHP files through SQLite ATTACH statements, achieving remote code execution. The patch introduced a regex filter to block ATTACH queries

Sources

  • CVE.orgVulnerability recordCVE-2026-96634

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-p96f-p2p2-2g3h

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-96634

    This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability (CVE-2021-43008) allowed authenticated users to create PHP files through SQLite ATTACH statements, achieving remote code execution. The patch introduced a regex filter to block ATTACH queries, but this f

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-p96f-p2p2-2g3h

    AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

    osv.dev

References

Freshness

Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitLab Advisory DatabaseNov 5, 2026
  • GitHub Advisory DatabaseNov 2, 2026
  • OpenSSF OSV / OSV ScannerNov 2, 2026
  • CVE.orgOct 31, 2026