Adminer before 6.1.1 contains a remote code execution flaw that allows an authenticated SQLite user to bypass ATTACH and VACUUM INTO restrictions by prefixing SQL statements with a UTF-8 byte-order mark. The attacker can attach a database file located at a PHP-served path and create a table whose name contains PHP code, which the web server then executes. This permits execution of arbitrary PHP code on the server, resulting in full compromise of the web application with the privileges of the web server user. The vulnerability is an example of code injection (CWE-94).

The vulnerability affects Adminer installations from vrana, specifically versions earlier than 6.1.1. Any deployment running a vulnerable version of Adminer, regardless of the operating system or web server, is susceptible.

The flaw has a CVSS score of 8.6, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack requires authentication to the Adminer SQLite database and leverages a flaw that bypasses access restrictions; attackers with such privileges can execute arbitrary PHP code on the web server. Because the flaw allows code execution with the web server's privileges, the potential impact is complete system compromise. The lack of EPSS data suggests limited publicly known exploitation, but the high CVSS and clear exploitation path indicate a significant risk for any organization using the affected Adminer version.