CVE-2026-34968
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Aug 25, 2026
Vendor
unknown
Description
Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.