{"apiVersion":"1.0","identifier":"CVE-2026-56702","description":"Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.","publishedAt":"2026-08-25T02:16:41","lastModifiedAt":"2026-08-27T17:18:52","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56702","cvssScore":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00343,"riskScore":0.91,"affectedProduct":"Adminer","affectedVersions":"<5.4.3","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-56702","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-56702","en":"https://www.redsauce.net/en/cves/CVE-2026-56702","fr":"https://www.redsauce.net/fr/cves/CVE-2026-56702","pt":"https://www.redsauce.net/pt/cves/CVE-2026-56702","de":"https://www.redsauce.net/de/cves/CVE-2026-56702","sk":"https://www.redsauce.net/sk/cves/CVE-2026-56702","el":"https://www.redsauce.net/el/cves/CVE-2026-56702"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-56702"}}