Which products and versions are affected by CVE-2026-25892?

Affected: Adminer versions >= >= 4.6.2, = 4.6.2. The full list is in the CVE brief.

Is CVE-2026-25892 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2026-25892 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2026-25892?

No public exploit code is known.

Is there a fix for CVE-2026-25892?

Fixed versions are available, including Adminer 5.4.2, vrana/adminer 5.4.2.

How urgently should CVE-2026-25892 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Request A Demo

Vulnerability Intelligence

CVE-2026-25892

High

Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

Published Feb 10, 2026 · Updated Aug 12, 2026 · Also known as GHSA-q4f2-39gr-45jh, UBUNTU-CVE-2026-25892

Key Facts

Patch in the next maintenance window

CVE-2026-25892 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Adminer, vrana/adminer (composer).
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 2.1% probability of exploitation in the next 30 days.
Fixed versions are available, including Adminer 5.4.2, vrana/adminer 5.4.2.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (30-day exploit likelihood)

2.1%

Higher than 81.1% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2026-25892 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.

Affected Products

15 affected entries in total

Product	Affected versions	Fixed in
AdminerAdminer	>= >= 4.6.2, < 5.4.2	5.4.2
vrana/adminercomposer	>= 4.6.2	5.4.2

Patched Releases

Adminer

5.4.2

vrana/adminer

5.4.2

Timeline

Publicly disclosed
Feb 10, 2026
Last updated
Aug 12, 2026

Weakness Type

CWE-20 Improper Input Validation

References

advisoryGHSA advisory
advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25892.json
advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2026-25892
advisoryhttps://ubuntu.com/security/CVE-2026-25892
advisoryhttps://www.cve.org/CVERecord?id=CVE-2026-25892

4 more references in the full CVE brief

FAQ

Common Questions.

Adminer is open-source database management software.
Affected: Adminer versions >= >= 4.6.2, < 5.4.2; vrana/adminer (composer) versions >= 4.6.2. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Adminer 5.4.2, vrana/adminer 5.4.2.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Is CVE-2026-25892 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.