{"id":"CVE-2026-121261","kind":"vulnerability","aliases":["CVE-2026-121261"],"related":[],"title":"phpMyAdmin ShapeFile: crafted SHP file makes the handler loop forever","description":"A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The ShapeFile library bundled with phpMyAdmin hangs in an infinite loop when it parses a crafted SHP file in ShapeRecord::loadFromFile. An attacker who can get such a file processed can tie up the handler and cause a denial of service.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyadmin","shapefile"],"not_affected_if":["no-shp-parsing"],"how_to_check":"- Check whether the `ShapeFile` library is installed in your phpMyAdmin or PHP project, for example with `composer show | grep -i shapefile`.\n- Look for any code path that calls `ShapeRecord::loadFromFile` on uploaded or remote SHP files.","fix":null,"status":"open","published_at":"2026-11-03T17:18:08+00:00","first_seen_at":"2026-11-03T17:21:56+00:00","triaged_at":"2026-11-03T17:24:32+00:00","updated_at":"2026-11-03T17:24:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T17:24:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"phpMyAdmin ShapeFile: crafted SHP file makes the handler loop forever","impact":"low","summary":"The ShapeFile library bundled with phpMyAdmin hangs in an infinite loop when it parses a crafted SHP file in ShapeRecord::loadFromFile. An attacker who can get such a file processed can tie up the handler and cause a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["phpmyadmin","php","shapefile"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Request handler hangs in an endless loop, causing denial of service","analyst_note":"Confirm the affected package and version range and whether a fixed release exists; sources only give up to 4.0.1 and the NVD entry.","how_to_check":"- Check whether the `ShapeFile` library is installed in your phpMyAdmin or PHP project, for example with `composer show | grep -i shapefile`.\n- Look for any code path that calls `ShapeRecord::loadFromFile` on uploaded or remote SHP files.","plain_action":"","needs_analyst":true,"not_affected_if":["no-shp-parsing"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000658,"input_tokens":4153,"output_tokens":486,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121261':13A,16A '-2026':12A,15A '4.0.1':72C 'attack':43B,92C 'bundl':24B 'caus':57B 'compon':81C 'contact':112C 'craft':3A,36B 'cve':11A,14A 'denial':59B 'disclos':101C 'disclosur':116C 'earli':113C 'execut':95C 'exploit':98C 'file':5A,38B,49B,83C 'forev':10A 'found':66C 'function':76C 'get':46B 'handler':8A,55B,84C 'hang':27B 'impact':73C 'infinit':30B,89C 'lead':87C 'librari':23B 'loadfromfil':41B,78C 'loop':9A,31B,90C 'make':6A 'manipul':86C 'may':106C 'packag':17B 'pars':34B 'php':18B 'phpmyadmin':1A,19B,26B,68C 'process':50B 'public':104C 'remot':96C 'respond':120C 'servic':61B 'shapefil':2A,20B,22B,69C 'shaperecord':40B,77C 'shp':4A,37B,82C 'tie':52B 'use':108C 'vendor':110C 'vulner':63C 'way':123C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","php","phpmyadmin","shapefile"],"campaign_type":null,"first_public_at":"2026-11-03T17:18:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121261","severity":null,"published_at":"2026-11-03T17:18:08+00:00","modified_at":"2026-11-03T17:18:08+00:00","first_seen_at":"2026-11-03T17:21:56+00:00","fetched_at":"2026-11-03T17:21:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}