Type Error in PHP Database Management Tool AdminNeo Affects Multiple Versions

CVE-2026-59978

What is CVE-2026-59978?

AdminNeo, a feature-rich PHP database management tool, is susceptible to a type error caused by improper handling of the ?script=version endpoint for versions 4.6.2 to 5.5.0. Attackers can exploit this vulnerability by sending unvalidated POST data, which allows them to manipulate the version parameter into a PHP array. This parameter is then serialized and incorrectly cached, leading to a type error when accessed later. As a result, the server generates HTTP 500 responses affecting all users until the cache is cleared or until a 24-hour period ends. A mitigation strategy includes setting the shared cache as unwritable to prevent potential exploitation.

References