AdminNeo SQLite Database-List Drop Arbitrary File Deletion

Summary AdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted db[] values directly to unlink(). Originally reported by @slpoiuewalspoid-dotcom in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-6pg3-chwq-wgqc Impact An authenticated AdminNeo SQLite user with a valid CSRF token can submit an arbitrary relative file path in the database-list db[] field. If the PHP process can delete that path, AdminNeo unlinks it even when the file is not a SQLite database. Root Cause The database-list page accepts selected database names from the POST body and calls dropdatabases(): php if ($POST["db"]) { queriesredirect(substr(ME, 0, -1), lang('Databases have been dropped.'), dropdatabases($POST["db"])); } In SQLite mode, dropdatabases() attaches an in-memory database and unlinks each submitted path directly: php function dropdatabases($databases): bool { Connection::get()->close(); // to unlock file, doesn't work in PDO on Windows foreach ($databases as $db) { if…

curl https://cve.zerocrew.in/api/cve/CVE-2026-96633