{"id":"CVE-2026-121263","kind":"vulnerability","aliases":["CVE-2026-121263"],"related":[],"title":"phpMyAdmin MoTranslator: locale argument allows path traversal from remote","description":"A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"MoTranslator, a PHP translation library used with phpMyAdmin, lets a crafted locale value in Loader::getTranslator escape its directory. An attacker who can reach the code remotely may read files the application can access, and a public exploit exists.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["composer","motranslator","package","php","phpmyadmin"],"not_affected_if":["locale-not-user-input","no-motranslator"],"how_to_check":"- Check whether the project depends on MoTranslator (look for `motranslator` in `composer.lock` or `vendor/`).\n- Check the installed version; the sources say versions up to `6.0.1` are affected.\n- Check whether the `locale` value from user requests reaches `Loader::getTranslator`.","fix":null,"status":"open","published_at":"2026-11-03T18:17:57+00:00","first_seen_at":"2026-11-03T18:22:10+00:00","triaged_at":"2026-11-03T18:22:33+00:00","updated_at":"2026-11-03T18:22:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T18:22:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"phpMyAdmin MoTranslator: locale argument allows path traversal from remote","impact":"medium","summary":"MoTranslator, a PHP translation library used with phpMyAdmin, lets a crafted locale value in Loader::getTranslator escape its directory. An attacker who can reach the code remotely may read files the application can access, and a public exploit exists.","audience":"developers","category":"package","nicknames":[],"who_cares":["php","phpmyadmin","motranslator","composer"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads arbitrary files the server process can access","analyst_note":"Confirm the affected package, whether a fixed MoTranslator release exists, and which phpMyAdmin versions bundle it; the NVD entry gives no fix.","how_to_check":"- Check whether the project depends on MoTranslator (look for `motranslator` in `composer.lock` or `vendor/`).\n- Check the installed version; the sources say versions up to `6.0.1` are affected.\n- Check whether the `locale` value from user requests reaches `Loader::getTranslator`.","plain_action":"","needs_analyst":true,"not_affected_if":["no-motranslator","locale-not-user-input"],"who_is_affected":"Applications that load MoTranslator (PHP translation library) with a locale value taken from user input are exposed. Projects that do not use MoTranslator, or that never pass request data as the locale, can skip it. The sources do not say which phpMyAdmin releases bundle the affected code.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000712,"input_tokens":4166,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121263':12A,15A '-2026':11A,14A '/src/loader.php':84C '6.0.1':69C 'access':54B 'allow':5A 'applic':52B 'argument':4A,90C 'attack':41B,98C 'code':46B 'compos':16B 'contact':117C 'craft':31B 'cve':10A,13A 'determin':63C 'directori':39B 'disclos':109C 'disclosur':121C 'earli':118C 'element':72C 'escap':37B 'execut':85C 'exist':59B 'exploit':58B,105C 'file':50B,80C 'function':75C 'gettransl':36B,77C 'impact':71C 'lead':93C 'let':29B 'librari':25B 'loader':35B,76C 'local':3A,32B,91C 'manipul':87C 'master':83C 'may':48B,99C,111C 'motransl':2A,17B,21B,66C,82C 'motranslator-mast':81C 'packag':18B 'path':6A,95C 'perform':101C 'php':19B,23B 'phpmyadmin':1A,20B,28B,65C 'public':57B,108C 'reach':44B 'read':49B 'remot':9A,47B,103C 'respond':125C 'translat':24B 'travers':7A,96C 'use':26B 'util':113C 'valu':33B 'vendor':115C 'vulner':61C 'way':128C","nicknames":[],"mitigations":[],"who_affected":"Applications that load MoTranslator (PHP translation library) with a locale value taken from user input are exposed. Projects that do not use MoTranslator, or that never pass request data as the locale, can skip it. The sources do not say which phpMyAdmin releases bundle the affected code.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["composer","medium","motranslator","package","php","phpmyadmin"],"campaign_type":null,"first_public_at":"2026-11-03T18:17:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121263","severity":null,"published_at":"2026-11-03T18:17:57+00:00","modified_at":"2026-11-03T18:17:57+00:00","first_seen_at":"2026-11-03T18:22:10+00:00","fetched_at":"2026-11-03T18:22:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}