Skip to content

Adminer

v5.4.3 Security

This release includes 8 security fixes for security teams reviewing exposed deployments.

Published 17d Relational Databases
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 8 known CVEs

Topics

database mssql mysql php postgresql sqlite

Affected surfaces

auth rbac rce_ssrf breaking_upgrade

ReleasePort's take

Moderate signal
editorial:auto 10d

The v5.4.3 release adds several security hardening measures for Adminer, including header validation, URI escaping, configuration checks, and restrictions on SQLite commands.

Why it matters: With severity scores of 90 across multiple security facts—such as validating Sec‑Fetch‑Site headers, escaping REQUEST_URI, disallowing dangerous SQLite ATTACH/VACUUM INTO operations—operators must apply these mitigations to protect request handling, URI processing, and database commands.

Summary

AI summary

Broad release touches PostgreSQL, SQLite, Select, and https://github.com/vrana/adminer/security/advisories/GHSA-33j4-hc95-pggg.

Changes in this release

Security Critical

Check Sec-Fetch-Site header for security validation

Check Sec-Fetch-Site header for security validation

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security Critical

Escape REQUEST_URI to prevent injection attacks

Escape REQUEST_URI to prevent injection attacks

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security Critical

Validate server configuration for security

Validate server configuration for security

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security Critical

Validate server version to ensure correct operation

Validate server version to ensure correct operation

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security Critical

Disallow SQLite ATTACH commands for security

Disallow SQLite ATTACH commands for security

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security Critical

Disallow SQLite VACUUM INTO commands for security

Disallow SQLite VACUUM INTO commands for security

Source: llm_adapter@2026-07-16

Confidence: high

 —
Security Critical

Check filename before deleting in SQLite to prevent errors

Check filename before deleting in SQLite to prevent errors

Source: llm_adapter@2026-07-16

Confidence: high

 —
Feature Medium

Allow sorting in Tables overview UI

Allow sorting in Tables overview UI

Source: llm_adapter@2026-07-16

Confidence: high

 —
Feature Medium

Disable Ctrl+click inline edit in Select view without UPDATE privilege

Disable Ctrl+click inline edit in Select view without UPDATE privilege

Source: llm_adapter@2026-07-16

Confidence: high

 —
Feature Low

Show new field in Foreign key error messages

Show new field in Foreign key error messages

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Feature Low

Order NULL values last in PostgreSQL query results

Order NULL values last in PostgreSQL query results

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Feature Low

Display all SQL command warnings once in PostgreSQL

Display all SQL command warnings once in PostgreSQL

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Feature Low

Include nextval() function when exporting PostgreSQL schemas

Include nextval() function when exporting PostgreSQL schemas

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Feature Low

Include REFERENCES clause when exporting PostgreSQL schemas

Include REFERENCES clause when exporting PostgreSQL schemas

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Feature Low

Add ~* operator support in PostgreSQL Editor (bug #1271)

Add ~* operator support in PostgreSQL Editor (bug #1271)

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Feature Low

Display tinyint(1) columns as checkboxes in Editor (bug #1246)

Display tinyint(1) columns as checkboxes in Editor (bug #1246)

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Bugfix Medium

Avoid unserialize() in brute force protection to prevent deserialization issues

Avoid unserialize() in brute force protection to prevent deserialization issues

Source: llm_adapter@2026-07-16

Confidence: high

 —
Bugfix Low

Display NULL in column title on Select view

Display NULL in column title on Select view

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Bugfix Low

Remember unchecked objects during Export (regression fix)

Remember unchecked objects during Export (regression fix)

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Bugfix Low

Export serial columns as serial type, not nextval() in PostgreSQL

Export serial columns as serial type, not nextval() in PostgreSQL

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Bugfix Low

Fix GENERATED AS IDENTITY export for PostgreSQL (bug #1260)

Fix GENERATED AS IDENTITY export for PostgreSQL (bug #1260)

Source: granite4.1:30b@2026-07-16-audit

Confidence: low

 —
Full changelog
  • Check Sec-Fetch-Site header (https://github.com/vrana/adminer/security/advisories/GHSA-33j4-hc95-pggg)
  • Escape REQUEST_URI (https://github.com/vrana/adminer/security/advisories/GHSA-c533-9qwm-8w5h, bug #1298)
  • Validate server (https://github.com/vrana/adminer/security/advisories/GHSA-r4x9-5m63-3vxw)
  • Validate server version (https://github.com/vrana/adminer/security/advisories/GHSA-h6jr-7pr6-grgj)
  • SQLite: Disallow ATTACH commands (https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh)
  • SQLite: Disallow VACUUM INTO commands (https://github.com/vrana/adminer/security/advisories/GHSA-gmx3-g29w-77wf)
  • SQLite: Check filename before deleting (https://github.com/vrana/adminer/security/advisories/GHSA-6pg3-chwq-wgqc)
  • Avoid unserialize() in brute force protection (bug #1289)
  • Tables overview: allow sorting (bug #1231)
  • Select: Disable Ctrl+click inline edit without UPDATE privilege
  • Select: Display NULL in column title
  • Export: Remember unchecked objects (regression from 5.0.6)
  • Foreign key: Display new field in case of an error
  • PostgreSQL: Order NULL last
  • PostgreSQL: Display all SQL command warnings and only once
  • PostgreSQL: Export serial as serial, not nextval()
  • PostgreSQL: Fix GENERATED AS IDENTITY export (bug #1260)
  • PostgreSQL: Export schema in nextval()
  • PostgreSQL: Export schema in REFERENCES
  • PostgreSQL: Add ~* operator (bug #1271)
  • Editor: Display tinyint(1) as checkbox (bug #1246, regression from 5.4.2)
  • Croatian translation

Security Fixes

  • GHSA-33j4-hc95-pggg — Check Sec-Fetch-Site header
  • GHSA-c533-9qwm-8w5h — Escape REQUEST_URI (bug #1298)
  • GHSA-r4x9-5m63-3vxw — Validate server
  • GHSA-h6jr-7pr6-grgj — Validate server version
  • GHSA-q4f2-39gr-45jh — SQLite: Disallow ATTACH commands
  • GHSA-gmx3-g29w-77wf — SQLite: Disallow VACUUM INTO commands
  • GHSA-6pg3-chwq-wgqc — SQLite: Check filename before deleting
  • Avoid unserialize() in brute force protection (bug #1289)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track Adminer

Get notified when new releases ship.

Sign up free

About Adminer

Database management in a single PHP file. Available for MySQL, MariaDB, PostgreSQL, SQLite, MS SQL, Oracle, Elasticsearch, MongoDB and others.

All releases →

Related context

Beta — feedback welcome: [email protected]