AdminNeo: version-cache array injection causes persistent denial of service
Affects AdminNeo versions from 4.6.2 up to but not including 5.5.0. The fix is in 5.5.0.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 5.5.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: poc
- Automatable: yes
- Technical impact: partial
Summary
AdminNeo, a PHP-based database management tool, is affected, specifically versions before 5.5.0. An unauthenticated remote attacker can poison a shared version cache so that every user of the instance receives server errors for up to 24 hours, effectively making the tool unavailable.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `bootstrap.inc.php` serializes into the shared `adminneo.version` cache. On later page loads, `design.inc.php` passes that cached value to `cookie()` and `rawurlencode()`, causing a `TypeError` rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: poc · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- adminneo-org adminneo
From 4.6.2 · fixed in 5.5.0
- adminneo-org/adminneoPackagist
From 4.6.2 · fixed in 5.5.0
References 3
GitHub · adminneo-org/adminneo
Questions about CVE-2026-59978
What does this mean?
The version-cache handling in AdminNeo can have array-type input injected into it, which causes a denial of service that persists. The flaw involves the adminneo.version file in the temp directory.Source: github.com
Am I affected, and how do I check?
AdminNeo versions from 4.6.2 up to but not including 5.5.0 are listed as affected. To check, compare the AdminNeo version in use against that range, and see whether the adminneo.version file in the temp directory (usually upload_tmp_dir) is present.Source: github.com
What should I do about it?
Upgrade AdminNeo to version 5.5.0 or later, which the listed fixed version. Until then, see the workaround for making the adminneo.version file unwritable by the web server.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.Source: cve.now feed data