Live › vulnerability › CVE-2026-121263
MoTranslator, a PHP translation library used with phpMyAdmin, lets a crafted locale value in Loader::getTranslator escape its directory. An attacker who can reach the code remotely may read files the application can access, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 18:22 UTC. All times on this page are UTC.
Applications that load MoTranslator (PHP translation library) with a locale value taken from user input are exposed. Projects that do not use MoTranslator, or that never pass request data as the locale, can skip it. The sources do not say which phpMyAdmin releases bundle the affected code.
No product ranges from the sources yet.
motranslator in composer.lock or vendor/).6.0.1 are affected.locale value from user requests reaches Loader::getTranslator.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121263")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.