Adminer before version 5.4.3 allows an authenticated attacker to delete any file writable by the PHP process by exploiting a flaw in SQLite mode where the database‑list drop action does not validate file extensions. The attacker can supply arbitrary relative paths in the db[] parameter, leading to removal of critical system files, configuration files, or user data, potentially causing data loss, service disruption, or further exploitation if deleted files contain executable code or configuration credentials.

The vulnerability affects the Adminer web database management tool, specifically all releases prior to 5.4.3. Any installation that enables SQLite mode and allows authenticated users to perform drop actions is potentially impacted.

The CVSS score of 7.2 indicates a medium to high severity vulnerability. Because the EPSS score is not available, the likelihood of exploitation in the wild is uncertain, though the lack of a documented public exploit suggests a lower immediate risk. The lack of inclusion in the CISA KEV catalog confirms there is no known active exploitation at the time of assessment. Attacks require the attacker to first authenticate to Adminer with sufficient privileges to initiate a drop operation, and the PHP process must have write permission to the target file path.