---
id: "CVE-2026-121262"
kind: "vulnerability"
aliases: ["CVE-2026-121262"]
title: "phpMyAdmin SQL-Parser: type conversion flaw in EXPLAIN statement parsing"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["composer", "package", "php", "phpmyadmin", "sql-parser"]
not_affected_if: ["no-untrusted-sql", "other-versions"]
published_at: "2026-11-03T17:18:08+00:00"
first_seen_at: "2026-11-03T17:21:56+00:00"
updated_at: "2026-11-03T17:24:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121262", "first_seen_at": "2026-11-03T17:21:56+00:00"}]
---

# phpMyAdmin SQL-Parser: type conversion flaw in EXPLAIN statement parsing

The phpMyAdmin SQL-Parser library (versions 6.0.0 and 6.0.1) mishandles a manipulated argument in its EXPLAIN statement parser, causing an incorrect type conversion. The sources do not state what an attacker gets beyond that, and a public exploit is reported to exist.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the `phpmyadmin/sql-parser` package, for example with `composer show phpmyadmin/sql-parser`
- Look for `src/Statements/ExplainStatement.php` in the vendor directory
- Confirm whether the parser is reached with untrusted SQL input

## Timeline

- 2026-11-03T17:21:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121262

## From the sources

A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_