CVE-2026-96633: 
PHP vulnerability analysis and mitigation

CVE-2026-96633 is an arbitrary file deletion vulnerability in AdminNeo's SQLite mode, classified as "AdminNeo SQLite Database-List Drop Arbitrary File Deletion." It affects all versions of the adminneo-org/adminneo Composer package prior to 5.5.1. The vulnerability was originally published on July 20, 2026, and added to the GitHub Advisory Database on October 30, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, AdminNeo Advisory).

The root cause is CWE-73 (External Control of File Name or Path): the drop_databases() function in admin/drivers/sqlite.inc.php passes user-supplied db[] POST values directly to PHP's unlink() without any extension or path validation. While the SQLite driver enforces a check_sqlite_name() guard (requiring .db, .sdb, or .sqlite extensions) for create and rename operations, this check is entirely absent from the drop/delete code path. An authenticated attacker with a valid CSRF token can submit an arbitrary file path — including paths outside the SQLite database directory — in the db[] field of a POST request to /?sqlite=&username=, causing the PHP process to delete any file it has write/delete permissions on (GitHub Advisory, AdminNeo Advisory).

Successful exploitation allows an authenticated attacker to delete arbitrary files accessible to the PHP process, including application source files, configuration files, session data, or other critical system files. This results in high integrity and availability impact — attackers can render the application inoperable, destroy data, or remove security controls — though there is no direct confidentiality impact (file contents are not disclosed). In scenarios where the PHP process has broad filesystem permissions, an attacker could delete files to facilitate further attacks such as forcing application reinstallation or removing authentication mechanisms (GitHub Advisory).

A concrete proof-of-concept (PoC) with step-by-step reproduction instructions and a crafted HTTP POST request is publicly available in the GitHub Security Advisory (GitHub Advisory). Exploitation requires authentication (low privileges) and a valid CSRF token, but no user interaction or elevated privileges beyond a standard SQLite-mode login. As of the advisory publication date, there is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the CVE status remains "Reserved" with no CISA KEV listing (AdminNeo Advisory).

1. Authenticate to AdminNeo: Log in to an AdminNeo instance running in SQLite mode (e.g., via /?sqlite=&username=) using valid credentials, obtaining an authenticated session cookie and a live CSRF token.
2. Identify a target file: Enumerate files writable by the PHP process (e.g., application PHP files, configuration files, or other web-accessible files such as /var/www/html/config.php).
3. Craft the malicious POST request: Construct an HTTP POST request to the database-list drop endpoint, substituting the target file path for a legitimate SQLite database name in the db[] parameter:

POST /?sqlite=&username= HTTP/1.1
Host: <target>
Cookie: <session_cookie>
Content-Type: application/x-www-form-urlencoded

db[]=/var/www/html/poc-delete-target.txt&all=&drop=Drop&token=<csrf_token>

4. Trigger file deletion: Submit the request. The server passes the db[] value directly to unlink() in drop_databases() without extension or path validation, deleting the specified file.
5. Confirm deletion: Verify the target file has been removed (e.g., by attempting to access it via HTTP or checking directory listings), confirming successful exploitation (GitHub Advisory, AdminNeo Advisory).

• Network: Unexpected HTTP POST requests to /?sqlite=&username= (or similar SQLite entry points) containing db[]= parameters with non-SQLite file paths (i.e., paths not ending in .db, .sdb, or .sqlite); requests originating from unusual source IPs for authenticated sessions.
• Logs: Web server access logs showing POST requests to the AdminNeo SQLite endpoint with db[] values referencing arbitrary file paths; application logs recording successful "Databases have been dropped" messages for non-database files.
• File System: Unexpected disappearance of application files (PHP scripts, configuration files, .txt, .log, or other non-SQLite files) from directories writable by the PHP process; missing files in /var/www/html/ or equivalent web root directories.
• Process: PHP process performing unlink() calls on files outside the expected SQLite database directory, observable via system call auditing tools (e.g., auditd with -a always,exit -F arch=b64 -S unlink) (GitHub Advisory).

Upgrade to AdminNeo version 5.5.1 or later, which applies check_sqlite_name() validation before calling unlink() in drop_databases(), restricting deletions to files with .db, .sdb, or .sqlite extensions (AdminNeo Release, Patch Commit). As interim mitigations: restrict AdminNeo access to trusted users only; minimize PHP process filesystem permissions to the SQLite database directory; and consider disabling SQLite mode entirely if it is not required for operations (GitHub Advisory).