Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.

Adminer versions before 5.4.3 contain a critical remote code execution vulnerability in SQLite query handling. The vulnerability arises because the VACUUM INTO command is not blocked despite existing ATTACH restrictions. Authenticated attackers can exploit this flaw to write arbitrary PHP code to any file path on the server. Once malicious PHP files are written, attackers can execute arbitrary commands on the server. The vulnerability requires authentication to exploit, reducing but not eliminating its risk. A fix is available in Adminer version 5.4.3 and later. The issue has been documented in GitHub security advisories and VulnCheck advisories. Organizations using Adminer for database management should update immediately to mitigate this risk.