{"id":"GHSA-6vfx-w7q3-42gq","aliases":["CVE-2026-96633"],"title":"AdminNeo SQLite Database-List Drop Arbitrary File Deletion","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"## Summary\n\nAdminNeo allows an authenticated SQLite-mode user to delete arbitrary files writable by the PHP process through the database-list drop action. The SQLite driver validates file extensions when creating or renaming databases, but the database-list drop path passes submitted `db[]` values directly to `unlink()`.\n\nOriginally reported by @slpoiuewalspoid-dotcom in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-6pg3-chwq-wgqc\n\n## Impact\n\nAn authenticated AdminNeo SQLite user with a valid CSRF token can submit an arbitrary relative file path in the database-list `db[]` field. If the PHP process can delete that path, AdminNeo unlinks it even when the file is not a SQLite database.\n\n## Root Cause\n\nThe database-list page accepts selected database names from the POST body and calls `drop_databases()`:\n\n```php\nif ($_POST[\"db\"]) {\n\tqueries_redirect(substr(ME, 0, -1), lang('Databases have been dropped.'), drop_databases($_POST[\"db\"]));\n}\n```\n\nIn SQLite mode, `drop_databases()` attaches an in-memory database and unlinks each submitted path directly:\n\n```php\nfunction drop_databases($databases): bool\n{\n\tConnection::get()->close(); // to unlock file, doesn't work in PDO on Windows\n\tforeach ($databases as $db) {\n\t\tif (!@unlink($db)) {\n\t\t\tConnection::get()->setError(lang('File exists.'));\n\t\t\treturn false;\n\t\t}\n\t}\n\treturn true;\n}\n```\n\nThe same SQLite driver protects create and rename operations with `check_sqlite_name()`, which requires a `.db`, `.sdb`, or `.sqlite` extension:\n\n```php\nfunction check_sqlite_name($name) {\n\t// avoid creating PHP files on unsecured servers\n\t$extensions = \"db|sdb|sqlite\";\n\tif (!preg_match(\"~^[^\\\\0]*\\\\.($extensions)\\$~\", $name)) {\n\t\tConnection::get()->setError(lang('Please use one of the extensions %s.', str_replace(\"|\", \", \", $extensions)));\n\t\treturn false;\n\t}\n\treturn true;\n}\n```\n\nThe drop path does not apply an equivalent extension check or bind the submitted path to a known listed SQLite database.\n\n## POC\n\n### 1. Start a complete AdminNeo application\n\nBuild and start AdminNeo from the audited source using the official standalone Docker image shape. The validation image copies the audited source tree into `/var/www/html` and starts Nginx HTTP server.\n\nLog in through the SQLite entry point using a SQLite database path `poc.sqlite`.\n\n### 2. Prepare a writable target file\n\nPlace a non-database file under a location writable by the AdminNeo PHP process. The validation used:\n\n```\n/var/www/html/poc-delete-target.txt\n```\n\nThe same directory also contained a SQLite database:\n\n```\n/var/www/html/poc.sqlite\n```\n\n### 3. Submit the database-list drop request\n\nUse the authenticated session and live CSRF token, but submit the non-database path as the selected database:\n\n```http\nPOST /?sqlite=&username= HTTP/1.1\nHost: <adminer-host>\nCookie: <authenticated-session>\nContent-Type: application/x-www-form-urlencoded\n\ndb[]=/var/www/html/poc-delete-target.txt&all=&drop=Drop&token=<live-csrf-token>\n```\n\nThe request reaches `drop_databases($_POST[\"db\"]),` and SQLite `drop_databases()` calls `unlink()` on the submitted non-database path.\n\nAfter the request, the `poc-delete-target.txt` was deleted.\n\n## Suggested Fix\n\nApply the same target validation used by SQLite create/rename before deleting database files. At minimum:\n- Reject paths whose basename does not end in `.db`, `.sdb`, or `.sqlite`.\n- Bind `db[]` values to databases returned by AdminNeo's database listing instead of trusting submitted paths.\n- Resolve paths before deletion and reject traversal outside the expected SQLite database directory.\n- Consider requiring the current selected database path for delete operations instead of accepting arbitrary submitted file paths.","severity":"high","score":8.1,"published":"2026-10-30T22:52:58.000Z","modified":"2026-10-30T23:00:04.343Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"adminneo-org/adminneo","sources":[{"name":"OSV · GHSA-6vfx-w7q3-42gq","url":"https://osv.dev/vulnerability/GHSA-6vfx-w7q3-42gq"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.5.1"}],"type":"ECOSYSTEM"}],"versions":["v4.10.0","v4.11.0","v4.12.0","v4.13.0","v4.14.0","v4.15.0","v4.16.0","v4.16.1","v4.17.0","v4.17.1","v4.17.2","v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.3.0","v4.3.1","v4.4.0","v4.5.0","v4.6.0","v4.6.1","v4.6.2","v4.6.3","v4.7.0","v4.7.1","v4.7.2","v4.7.3","v4.7.4","v4.7.5","v4.7.6","v4.7.7","v4.7.8","v4.7.9","v4.8.0","v4.8.1","v4.8.2","v4.9.0","v4.9.1","v4.9.2","v4.9.3","v4.9.4","v5.0.0","v5.0.0-rc","v5.1.0","v5.1.1","v5.2.0","v5.2.1","v5.3.0","v5.4.0","v5.4.1","v5.5.0"],"fixed":["5.5.1"]}],"sourceAffected":[],"references":["https://github.com/adminneo-org/adminneo/security/advisories/GHSA-6vfx-w7q3-42gq","https://github.com/adminneo-org/adminneo/commit/26fcef2f32922629751cbea6c0bb593fbf1e957d","https://github.com/adminneo-org/adminneo","https://github.com/adminneo-org/adminneo/releases/tag/v5.5.1"],"sources":[{"name":"OSV","id":"GHSA-6vfx-w7q3-42gq","modified":"2026-10-30T23:00:04.343164827Z","url":"https://osv.dev/vulnerability/GHSA-6vfx-w7q3-42gq"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1}],"products":[],"remediation":[],"observedAt":"2026-10-30T23:33:26.874Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T06:35:33.858Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T23:50:35.021Z","attemptedAt":"2026-10-30T23:50:35.021Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T23:50:35.021Z","attemptedAt":"2026-10-30T23:50:35.021Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T23:50:35.021Z","attemptedAt":"2026-10-30T23:50:35.021Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T23:50:35.259Z","attemptedAt":"2026-10-30T23:50:35.259Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-6vfx-w7q3-42gq","url":"https://github.com/advisories/GHSA-6vfx-w7q3-42gq","modified":"2026-10-30T22:53:01Z","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","checkedAt":"2026-10-30T23:50:35.021Z"}],"aiSummary":null}