Live › vulnerability › CVE-2026-121261
The ShapeFile library bundled with phpMyAdmin hangs in an infinite loop when it parses a crafted SHP file in ShapeRecord::loadFromFile. An attacker who can get such a file processed can tie up the handler and cause a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
No product ranges from the sources yet.
ShapeFile library is installed in your phpMyAdmin or PHP project, for example with composer show | grep -i shapefile.ShapeRecord::loadFromFile on uploaded or remote SHP files.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121261")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.