---
id: "CVE-2026-121261"
kind: "vulnerability"
aliases: ["CVE-2026-121261"]
title: "phpMyAdmin ShapeFile: crafted SHP file makes the handler loop forever"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "phpmyadmin", "shapefile"]
not_affected_if: ["no-shp-parsing"]
published_at: "2026-11-03T17:18:08+00:00"
first_seen_at: "2026-11-03T17:21:56+00:00"
updated_at: "2026-11-03T17:24:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121261", "first_seen_at": "2026-11-03T17:21:56+00:00"}]
---

# phpMyAdmin ShapeFile: crafted SHP file makes the handler loop forever

The ShapeFile library bundled with phpMyAdmin hangs in an infinite loop when it parses a crafted SHP file in ShapeRecord::loadFromFile. An attacker who can get such a file processed can tie up the handler and cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the `ShapeFile` library is installed in your phpMyAdmin or PHP project, for example with `composer show | grep -i shapefile`.
- Look for any code path that calls `ShapeRecord::loadFromFile` on uploaded or remote SHP files.

## Timeline

- 2026-11-03T17:21:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121261

## From the sources

A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_