{"id":"CVE-2026-121262","kind":"vulnerability","aliases":["CVE-2026-121262"],"related":[],"title":"phpMyAdmin SQL-Parser: type conversion flaw in EXPLAIN statement parsing","description":"A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"The phpMyAdmin SQL-Parser library (versions 6.0.0 and 6.0.1) mishandles a manipulated argument in its EXPLAIN statement parser, causing an incorrect type conversion. The sources do not state what an attacker gets beyond that, and a public exploit is reported to exist.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["composer","package","php","phpmyadmin","sql-parser"],"not_affected_if":["no-untrusted-sql","other-versions"],"how_to_check":"- Check the installed version of the `phpmyadmin/sql-parser` package, for example with `composer show phpmyadmin/sql-parser`\n- Look for `src/Statements/ExplainStatement.php` in the vendor directory\n- Confirm whether the parser is reached with untrusted SQL input","fix":null,"status":"open","published_at":"2026-11-03T17:18:08+00:00","first_seen_at":"2026-11-03T17:21:56+00:00","triaged_at":"2026-11-03T17:24:22+00:00","updated_at":"2026-11-03T17:24:22+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-03T17:24:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"phpMyAdmin SQL-Parser: type conversion flaw in EXPLAIN statement parsing","impact":"medium","summary":"The phpMyAdmin SQL-Parser library (versions 6.0.0 and 6.0.1) mishandles a manipulated argument in its EXPLAIN statement parser, causing an incorrect type conversion. The sources do not state what an attacker gets beyond that, and a public exploit is reported to exist.","audience":"developers","category":"package","nicknames":[],"who_cares":["php","composer","phpmyadmin","sql-parser"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; sources describe only an incorrect type conversion","analyst_note":"Confirm the impact of the type conversion flaw and whether a fixed version exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121262 and the upstream phpMyAdmin SQL-Parser repository.","how_to_check":"- Check the installed version of the `phpmyadmin/sql-parser` package, for example with `composer show phpmyadmin/sql-parser`\n- Look for `src/Statements/ExplainStatement.php` in the vendor directory\n- Confirm whether the parser is reached with untrusted SQL input","plain_action":"","needs_analyst":true,"not_affected_if":["other-versions","no-untrusted-sql"],"who_is_affected":"Applications that pull in phpMyAdmin SQL-Parser 6.0.0 or 6.0.1 and pass it SQL text that can be influenced from outside, such as query tools or admin consoles. Systems that do not use these versions, or never parse untrusted SQL, are unlikely to be exposed. The sources do not say which parse inputs trigger the flaw beyond the nextToken argument.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000767,"input_tokens":4168,"output_tokens":700,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121262':14A,17A '-2026':13A,16A '/6.0.1':78C '6.0.0':32B,77C '6.0.1':34B 'affect':80C 'argument':38B,95C 'attack':56B,103C 'beyond':58B 'carri':108C 'caus':44B 'compos':18B 'contact':124C 'convers':6A,48B,101C 'could':118C 'cve':12A,15A 'disclosur':128C 'earli':125C 'element':81C 'exist':67B 'explain':9A,41B 'exploit':63B,112C 'file':88C 'flaw':7A 'found':71C 'function':84C 'get':57B 'incorrect':46B,99C 'librari':30B 'made':115C 'manipul':37B,92C 'mishandl':35B 'nexttoken':96C 'packag':19B 'pars':11A,85C 'parser':4A,24B,29B,43B,76C 'perform':90C 'php':20B 'phpmyadmin':1A,21B,26B,73C 'possibl':105C 'public':62B,116C 'remot':110C 'report':65B 'respond':132C 'result':97C 'sourc':50B 'sql':3A,23B,28B,75C 'sql-parser':2A,22B,27B,74C 'src/statements/explainstatement.php':89C 'state':53B 'statement':10A,42B 'type':5A,47B,100C 'use':120C 'vendor':122C 'version':31B 'vulner':69C 'way':135C","nicknames":[],"mitigations":[],"who_affected":"Applications that pull in phpMyAdmin SQL-Parser 6.0.0 or 6.0.1 and pass it SQL text that can be influenced from outside, such as query tools or admin consoles. Systems that do not use these versions, or never parse untrusted SQL, are unlikely to be exposed. The sources do not say which parse inputs trigger the flaw beyond the nextToken argument.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["composer","medium","package","php","phpmyadmin","sqlparser"],"campaign_type":null,"first_public_at":"2026-11-03T17:18:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121262","severity":null,"published_at":"2026-11-03T17:18:08+00:00","modified_at":"2026-11-03T17:18:08+00:00","first_seen_at":"2026-11-03T17:21:56+00:00","fetched_at":"2026-11-03T17:21:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}