The sql-log plugin in Adminer 5.3.0 through 5.4.2 contains a flaw in the ns parameter that does not properly validate user input. An authenticated user can include path traversal sequences in that parameter to create or overwrite any .sql file with attacker‑controlled content in any directory that the web process can write to. This allows the attacker to place arbitrary SQL files on the host system, potentially modifying data or leaving persistence files for later use.

The vulnerability affects Adminer versions 5.3.0 through 5.4.2 when the sql-log plugin is enabled. The vendor is vrana, and the product is Adminer. Organizations running these specific versions with the plugin enabled should evaluate the risk.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is published, and the vulnerability is not listed in CISA KEV. An attacker must have valid authentication and the sql-log plugin must be active to exploit this weakness. The attack vector is web‑application based, requiring credential use and the presence of a writable directory to achieve arbitrary file write.