Adminer: A 2021 Patch Bug Returns as RCE — The CVE-2026-15686…

Vulnerability ZDI-26-478 shows how a fix for CVE-2021-43008 introduced a new RCE vector via catastrophic backtracking in preg_match().

On July 29, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-478 detailing a remote code execution flaw in Adminer, the popular PHP database administration tool. The story isn't just the vulnerability itself — it's that the flaw stems from an implementation error introduced five years earlier to fix CVE-2021-43008, demonstrating how rushed patches can spawn attack vectors more complex than the originals.

Researcher 0daystolive, working with ZDI, discovered that the regex filter added in 2021 to block SQLite ATTACH statements is bypassable through a PHP type confusion mechanism: when preg_match() returns false due to exceeding the backtracking limit, the code treats it as 0 (no match), allowing arbitrary code execution to proceed.

Key Takeaways

CVE-2026-15686 is a bypass of the patch for CVE-2021-43008, not a new flaw in the same component.
The exploit leverages catastrophic backtracking in a regex with a possessive quantifier *+ and SQLite comments --, forcing preg_match() to return false.
The vulnerable code checks only for truthy values, treating false the same as 0: the ATTACH filter is bypassed, enabling creation of executable PHP files.
Authentication is required for exploitation, but the attack surface remains significant in environments with weak or already-compromised credentials.

From CVE-2021-43008 to ZDI-26-478

The story begins in 2021, when CVE-2021-43008 revealed that Adminer allowed authenticated users to create PHP files via SQLite ATTACH statements. The patch responded with a regex filter designed to intercept and block these statements before execution. According to converging sources, that filter remained vulnerable to an unanticipated class of attack: catastrophic backtracking.

Advisory ZDI-26-478 describes the flaw as an "Incorrect Check of Function Return Value" in the multi_query method — a technically generic description that masks a specific PHP type-system issue. The function preg_match() returns int|false — 1 for a match, 0 for no match, false for error or backtracking limit exceeded. The patch code checked only whether the result was "truthy" in PHP's boolean sense, meaning 1. Both 0 and false were interpreted identically: no match detected, proceed with the operation.

The Mechanism: How the Regex Becomes a Weapon

The GitHub Security Advisory GHSA-3582-q6xq-5vf7 technical analysis reconstructs the exact pattern: an optional whitespace sequence defined as a combination of whitespace, block comments /* ... */, line comments # or --, with a possessive quantifier *+ that prevents normal backtracking. The attacker generates roughly 350,000 lines of SQLite -- comments before the malicious ATTACH statement.

This sequence triggers a combinatorial explosion in PHP's regex engine. The exponential backtracking exceeds the internal limit, preg_match() returns false, and the vulnerable code — which does not distinguish false from 0 — treats the check as passed. The filter collapses. The ATTACH statement proceeds, creating a SQLite database with a .php extension containing arbitrary code executable by the web server.

The documented proof-of-concept creates a file named lol.php in the Adminer directory. The name is not accidental: it underscores that the attacker has full control over the payload's content and placement, within the web server process context.

"the code only checks for truthy values (1 for match), treating false the same as 0 (no match). This allows the ATTACH statement to bypass the security filter." — GitHub Security Advisory GHSA-3582-q6xq-5vf7

Timeline and Coordinated Disclosure

The vulnerability was reported to the vendor on March 6, 2026. Following ZDI's standard ~120-day vendor response window, the advisory was published on July 29, 2026 with a coordinated release. The ZDI advisory confirms Adminer released a corrective update, though specific patched version details are not fully documented in available sources: the research PoC uses version 5.4.2.

The CVE-2026-15686 record, viewable on cve.org, currently shows a "reserved" status: confirming the identifier's existence without yet exposing the full technical entry. This combination — detailed ZDI advisory, GitHub analysis with source code and PoC, CVE still being finalized — is typical of disclosures nearing completion.

What to Do Now

Verify whether your Adminer instance is updated to the patched version released after the July 29, 2026 disclosure.
Reassess Adminer exposure in production: the tool is built for administration and should not be accessible from untrusted networks.
Review authentication controls: the exploit requires valid credentials, so password strength and rotation after any prior compromise are direct mitigating factors.
Inspect logs for SQLite ATTACH activity or creation of .php files in web-served directories — anomalous patterns given the documented attack nature.

Why This Case Changes the Perspective on Security Regexes

The lesson of CVE-2026-15686 extends beyond Adminer. Every security filter based on regular expressions in PHP — and not only — must contend with the edge-case behavior of preg_match(). The language returns three semantically distinct states compressed into an int|false type; code that does not explicitly handle false as an error condition, rather than a non-match, is technically fragile.

Catastrophic backtracking is not a theoretical curiosity. Here it became the bridge between an apparently innocuous input — SQL comments — and remote code execution. The next time a security team proposes a regex as a quick fix to block a vector, this case offers a concrete counter-model of how the quick fix can become the next problem.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references