CVE-2026-59978 Details
Description
AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `bootstrap.inc.php` serializes into the shared `adminneo.version` cache. On later page loads, `design.inc.php` passes that cached value to `cookie()` and `rawurlencode()`, causing a `TypeError` rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0.
A denial-of-service vulnerability has been identified in AdminNeo, a PHP-based database management tool, affecting versions 4.6.2 prior to 5.5.0. The issue arises in the `?script=version` endpoint, which accepts POST data without proper validation. This endpoint, intended to receive version information from the GitHub API, lacks origin and CSRF validation, allowing unauthenticated users to inject data. When the `version[]` parameter is used, PHP interprets it as an array. This array is then serialized and stored in a shared cache, but on subsequent page loads, it causes a `TypeError` by being passed to functions that expect a string. As a result, the server returns an HTTP 500 error, disrupting service for all users for 24 hours or until the cached data is cleared. The vulnerability can be exploited if the web server has write access to the shared cache.
Users can upgrade to AdminNeo version 5.5.0, which addresses this vulnerability. If an immediate upgrade is not possible, the `adminneo.version` file in the temporary directory can be made unwritable by the web server as a temporary workaround.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/adminneo-org/adminneo/commit/b7ae929e6afb374f0a7aba3d73b7d441470ff907 | [email protected] | Source CodeVendor |
| https://github.com/adminneo-org/adminneo/releases/tag/v5.5.0 | [email protected] | Release NotesVendor |
| https://github.com/adminneo-org/adminneo/security/advisories/GHSA-jm85-8cpp-9cjc | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| AdminNeo | >= 4.6.2, < 5.5.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |