---
id: "CVE-2026-121263"
kind: "vulnerability"
aliases: ["CVE-2026-121263"]
title: "phpMyAdmin MoTranslator: locale argument allows path traversal from remote"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["composer", "motranslator", "package", "php", "phpmyadmin"]
not_affected_if: ["locale-not-user-input", "no-motranslator"]
published_at: "2026-11-03T18:17:57+00:00"
first_seen_at: "2026-11-03T18:22:10+00:00"
updated_at: "2026-11-03T18:22:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121263", "first_seen_at": "2026-11-03T18:22:10+00:00"}]
---

# phpMyAdmin MoTranslator: locale argument allows path traversal from remote

MoTranslator, a PHP translation library used with phpMyAdmin, lets a crafted locale value in Loader::getTranslator escape its directory. An attacker who can reach the code remotely may read files the application can access, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project depends on MoTranslator (look for `motranslator` in `composer.lock` or `vendor/`).
- Check the installed version; the sources say versions up to `6.0.1` are affected.
- Check whether the `locale` value from user requests reaches `Loader::getTranslator`.

## Timeline

- 2026-11-03T18:22:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121263

## From the sources

A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_