Adminer, a lightweight database management tool, is vulnerable in versions prior to 5.4.3. The flaw lies in SQLite query handling where the VACUUM INTO command is allowed even when ATTACH restrictions should prevent it. This oversight enables an authenticated attacker to write arbitrary PHP code to any file path and immediately execute it, granting full remote code execution on the server. The weakness corresponds to code injection as identified by CWE‑94.

The issue affects the Adminer web application developed by vrana, for all releases before 5.4.3. Any deployment running Adminer 5.4.2 or older, regardless of platform, is vulnerable.

The CVSS score of 8.6 indicates a high‑severity flaw. Although the EPSS score is not available, the vulnerability is not yet listed in the CISA KEV catalog, implying no widespread public exploitation at this time. However, the flaw requires authentication, so it is likely to be leveraged by attackers who have compromised a user account on the target system. The attack path involves submitting a specially crafted SQLite query that uses VACUUM INTO to write malicious PHP to a web‑accessible location and then triggering its execution.