Is CVE-2026-56702 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-56702?

CVE-2026-56702 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-56702

Description

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.