CVE-2026-56702
Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUploadAdminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-server user when uploadPath is web-served.
We have discovered 271 live websites that are affected by CVE-2026-56702.
Affected Software
| Product |  Adminer |
| Category | Database Managers |
| Vulnerable Domains | 271 live websites (100% of Adminer install base) |
| Vulnerable Versions |
|
| Vulnerable Versions Count | 16 versions ( 89% of all versions) |
Details
- Published - Aug 25, 2026
- Updated - Aug 27, 2026
Credits
- riodrwn (reporter)
CVE References
Website Distribution by Country
Number of websites using CVE-2026-56702 United States | 43 websites |
 Czech Republic | 87 websites |
 Germany | 55 websites |
 France | 26 websites |
 Slovakia | 9 websites |
 Sweden | 7 websites |
 Belgium | 6 websites |
 Australia | 4 websites |
 China | 4 websites |
 Spain | 4 websites |
Website Distribution by TLD
Number of websites using CVE-2026-56702| .cz | 83 websites |
| .com | 61 websites |
| .de | 24 websites |
| .net | 19 websites |
| .eu | 14 websites |
| .fr | 8 websites |
| .se | 6 websites |
| .be | 5 websites |
| .ch | 5 websites |
| .ru | 4 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redWebsites affected by CVE-2026-56702
Top websites that are affected by CVE-2026-56702. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| *****.********.com | Czech Republic | **,*** | |
| *******.*****.cz | Czech Republic | ***,*** | |
| ******.*************.cz | Czech Republic | ***,*** | |
| *******.***.cn | China | ***,*** | |
| ***.*******.net |  Poland | *,***,*** | |
| ***.*************.de | Germany | *,***,*** | |
| ****.********.net | United States | *,***,*** | |
| ********.cz | Germany | *,***,*** | |
| ***.**************.de | Germany | *,***,*** | |
| *****************.*******************.de | Germany | *,***,*** |
FAQ
A total of 271 websites have been identified as vulnerable to CVE-2026-56702, based on global website indexing conducted by WebTechSurvey.
The Adminer is affected by the CVE-2026-56702 vulnerability.
Adminer versions up to 5.4.3 are vulnerable to CVE-2026-56702.
CVE-2026-56702 is resolved in version 5.4.3 of Adminer.