Server-Side Request Forgery in phpMyAdmin by vendor phpMyAdmin
CVE-2026-119428

6.3MEDIUM

Key Information:

Vendor

PHPmyadmin
Status
PHPmyadmin
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119428?

phpMyAdmin through version 5.2.3 contains a server-side request forgery (SSRF) vulnerability that can be exploited by unauthenticated attackers. The issue resides in 'setup/validate.php', which is missing necessary safeguards. By sending crafted POST requests with selected host and port values, attackers can trigger outbound connections to the specified hosts, making it possible to open MySQL-protocol connections and potentially probe internal ports. This vulnerability could lead to the exposure of sensitive information through the error messages returned by the system.

Affected Version(s)

phpMyAdmin 0 <= 5.2.3

References

https://github.com/phpmyadmin/phpmyadmin/commit/510e44259...
patch
https://github.com/phpmyadmin/phpmyadmin/commit/126ac3ac5...
patch
https://github.com/phpmyadmin/phpmyadmin/pull/19156
patchissue-tracking

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
MaurĂ­cio Meneghini Fauth
.