---
id: "CVE-2026-119427"
kind: "vulnerability"
aliases: ["CVE-2026-119427"]
title: "phpMyAdmin: Designer settings save lets logged-in users inject SQL"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mariadb", "mysql", "package", "phpmyadmin", "self-hosted"]
not_affected_if: ["auth-required", "phpmyadmin-newer-than-5.2.3"]
published_at: "2026-10-30T12:16:39+00:00"
first_seen_at: "2026-10-30T12:30:25+00:00"
updated_at: "2026-10-30T12:34:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119427", "first_seen_at": "2026-10-30T12:30:25+00:00"}]
---

# phpMyAdmin: Designer settings save lets logged-in users inject SQL

phpMyAdmin through 5.2.3 fails to escape JSON output in the Designer saveSetting() function, so SQL can be injected through the index or value parameters. An authenticated user can overwrite other users' Designer settings or run queries against the controluser database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed phpMyAdmin version (for example `phpMyAdmin --version` or the version shown in the footer) and see whether it is `5.2.3` or older
- Confirm whether the Designer feature is reachable by users, by looking for requests to `/database/designer` with `operation=save_setting_value` in the web server access logs

## Fix

- Move phpMyAdmin to a version newer than `5.2.3`; the sources do not name the fixed release

## Timeline

- 2026-10-30T12:30:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119427

## From the sources

phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operation=save_setting_value to /database/designer to overwrite other users' designer settings or run controluser subqueries.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_