Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.

CVE-2026-34968 affects Adminer versions before 5.4.3, exposing a critical arbitrary file deletion vulnerability in SQLite mode. The flaw exists in the database-list drop action, which fails to validate file extensions before performing deletions. An authenticated attacker can exploit this by submitting arbitrary relative file paths via the db[] parameter. This allows deletion of any file writable by the PHP process running Adminer. The vulnerability requires authentication but can have severe impact on server integrity and availability. It was patched in Adminer version 5.4.3. Multiple advisories have been published including on GitHub Security Advisories and VulnCheck. Organizations using Adminer in SQLite mode should upgrade immediately to mitigate risk.