CVE-2026-59978: CVE-2026-59978: Persistent Denial of Service via Array Injection in AdminNeo

#security #cve #cybersecurity

CVE-2026-59978: Persistent Denial of Service via Array Injection in AdminNeo

Vulnerability ID: CVE-2026-59978
CVSS Score: 7.5
Published: 2026-10-30

AdminNeo versions 4.6.2 through 5.4.1 contain an improper input validation vulnerability (CWE-20) in the version verification endpoint (?script=version). An unauthenticated remote attacker can submit a crafted HTTP POST request containing an array parameter for 'version', which is serialized into a shared server-side temporary cache file without type checking or authentication. On subsequent requests, the application deserializes this cached array and passes it to cookie() and rawurlencode(), triggering an uncaught fatal TypeError in PHP 8.x environments and causing a persistent 24-hour Denial of Service (DoS) for all users.

TL;DR

An unauthenticated remote attacker can pass an array parameter (version[]=...) to the ?script=version endpoint in AdminNeo (< 5.5.0). The injected array is cached on disk for 24 hours and subsequently passed to rawurlencode(), triggering an unhandled PHP 8 TypeError and resulting in an application-wide HTTP 500 Denial of Service.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: CWE-20: Improper Input Validation (Type Confusion / DoS)
CVSS v3.1 Score: 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Attack Vector: Network (Unauthenticated HTTP POST to ?script=version)
Affected Versions: adminneo-org/adminneo >= 4.6.2, < 5.5.0
Patched Version: 5.5.0
Impact: Persistent 24-hour application-wide HTTP 500 Denial of Service
Exploit Status: Public Proof-of-Concept (PoC) available
CISA KEV Status: Not Listed

Affected Systems

adminneo-org/adminneo
AdminNeo: >= 4.6.2, < 5.5.0 (Fixed in: 5.5.0)

Code Analysis

Commit: b7ae929

Avoid denial-of-service via version check

diff --git a/admin/include/bootstrap.inc.php b/admin/include/bootstrap.inc.php
index 42adbe7a4..7e1810a4b 100644
--- a/admin/include/bootstrap.inc.php
+++ b/admin/include/bootstrap.inc.php
@@ -41,17 +41,6 @@
 // Compiled files loading.
 include __DIR__ . "/../file.inc.php";

-if ($_GET["script"] == "version") {
-   $filename = get_temp_dir() . "/adminneo.version";
-   @unlink($filename); // It may not be writable by us, @ - it may not exist.
-
-   $file = open_file_with_lock($filename);
-   if ($file) {
-       write_and_unlock_file($file, serialize(["version" => $_POST["version"]]));
-   }
-   exit;
-}
-
 if (!$_SERVER["REQUEST_URI"]) { // IIS 5 compatibility
    $_SERVER["REQUEST_URI"] = $_SERVER["ORIG_PATH_INFO"];
 }
@@ -100,6 +89,9 @@
    cookie("neo_import", "", -3600);
 }

+// Remove unused file.
+@unlink(get_temp_dir() . "/adminneo.version");
+
 include __DIR__ . "/../core/Locale.php";
 include __DIR__ . "/lang.inc.php";

Commit: 21d3a31

Upstream Adminer fix commit removing server-side version caching

Exploit Details

GitHub Security Advisory: Official advisory containing curl proof-of-concept demonstrating unauthenticated version cache poisoning.

Mitigation Strategies

Upgrade AdminNeo to version 5.5.0 or later to eliminate the server-side version caching endpoint.
Restrict filesystem permissions on the /tmp/adminneo.version file so the PHP web server process cannot overwrite it.
Filter and block requests containing the query parameter 'script=version' using a Web Application Firewall (WAF) or reverse proxy.
Disable version verification in the AdminNeo configuration if outbound update checks are unnecessary.

Remediation Steps:

Download and deploy AdminNeo 5.5.0 from the official release repository or update via Composer (composer update adminneo-org/adminneo).
If currently experiencing an HTTP 500 outage on an unpatched instance, delete the poisoned temporary file (rm -f /tmp/adminneo.version) to immediately restore service.
If unable to patch immediately, create an immutable dummy file (touch /tmp/adminneo.version && chown root:root /tmp/adminneo.version && chmod 0444 /tmp/adminneo.version).
Verify remediation by testing curl -X POST 'http://target/?script=version' -d 'version[]=test' and confirming that subsequent GET requests return HTTP 200.

References

Read the full report for CVE-2026-59978 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community