CVE-2026-119428
Phpmyadmin: server-side request forgery
- Risk score
- 45/100
- CVSS
- 5.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-…
- Affected
- Phpmyadmin
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- Public proof of concept
Story map
At a glance
Phpmyadmin: Amber, patch this week. phpMyAdmin through 5.2.3 contains a cross-site request forgery vulnerability that allows remote attackers to execute arbitrary SQL by bypassing CSRF token checks on non-AJAX POST requests. Attackers can execute arbitrary SQL with the victim's database privileges.
The flaws
- CVE-2026-119428: Server-side request forgery (CVSS 5.8 · EPSS 0%)
- CVE-2026-119426: Cross-site request forgery (CVSS 8.8 · EPSS 0%)
- CVE-2026-119427: SQL injection (CVSS 8.8 · EPSS 0%)
- CVE-2026-119562: SQL injection (CVSS 8.8 · EPSS 0%)
The fix
Fix: Upgrade to a version greater than 5.2.3
Who is exposed: {'products': ['phpMyAdmin'], 'packages': [], 'versions': ['5.2.3']}
Where it stands
- Public proof of concept
Connects to
- Same weakness: Server-side request forgery (CWE-918). 271 other warnings in 30 days
- Same product: Earlier Phpmyadmin warnings. 3 in the last 90 days
Why it is Yellow
- CVSS 5.8 medium
- Public exploit or proof of concept referenced
References
- https://abraxaslabs.tech/research/phpmyadmin-setup-validate
- https://github.com/phpmyadmin/phpmyadmin
- https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Config/Validator.php#L241
- https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/setup/validate.php#L21-L35
- https://github.com/phpmyadmin/phpmyadmin/commit/126ac3ac5662ed3171ef3646636348fad3f8e952
- https://github.com/phpmyadmin/phpmyadmin/commit/510e442593af5d4702bbb46cdb45ad51f3a8a9d3
- https://github.com/phpmyadmin/phpmyadmin/pull/19156
- https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-ssrf-via-setup-validate-php-after-setup-disabled
Original description
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.
Last activity 30 Oct 2026. Patch Forecast updates every hour.