GHSA-x5r2-hj5c-8jx6 GHSA-x5r2-hj5c-8jx6
SSRF in adminer
- Severity
- 7.2 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 98.46%
- Chance of exploitation in the next 30 days. Higher than 99.92% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog
- Weakness
- CWE-918 Server-Side Request Forgery (SSRF)
- Fix
4.7.9- Upgrade vrana/adminer to this version or later
Description
Impact
Users of Adminer versions bundling all drivers (e.g. adminer.php) are affected.
Patches
Patched by ccd2374b, included in version 4.7.9.
Workarounds
- Use a single driver version (e.g.
adminer-mysql.php). - Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP plugin.
References
https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf
For more information
If you have any questions or comments about this advisory:
- Comment at ccd2374b.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| vrana/adminer | < 4.7.9 |
4.7.9 |
| vrana/adminer | < 4.7.9 |
4.7.9 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
vrana/adminer Packagist → 4.7.9
- composer
composer require vrana/adminer:^4.7.9
Severity breakdown
CVSS 3.1 7.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
- Exploit maturity
- H
Weakness
CWE-918: Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney | Not rated yet | Same weakness, CWE-918 |
| GHSA-2wqp-q3c6-ccj5 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints | Medium | Same weakness, CWE-918 |
| GHSA-2phh-27fw-q4gc PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading | Medium | Same weakness, CWE-918 |
| GHSA-p3pr-8f3m-4qp8 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host | Medium | Same weakness, CWE-918 |
| GHSA-j8f7-x8jm-wmm4 Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling) | Medium | Same weakness, CWE-918 |
| GHSA-r7f2-6fj8-6fg2 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses | Medium | Same weakness, CWE-918 |
| GHSA-322m-ff4g-9vx9 Ghost: Server-Side Request Forgery in Bookmark Fetching | Medium | Same weakness, CWE-918 |
| GHSA-cjq9-62q9-8jv4 Next.js has Server-Side Request Forgery in Image Optimization | Medium | Same weakness, CWE-918 |
Credits: UNC1739, bpsizemore
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor