CVE-2026-34968

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode . The root cause is that the database-list drop action fails to validate file extensions before deletion, allowing an authenticated attacker to submit arbitrary relative file paths in the db[] parameter to delet...