{"id":"CVE-2026-59978","summary":"AdminNeo: version-cache array injection causes persistent denial of service","details":"AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type validation. A `version[]` parameter becomes a PHP array that `bootstrap.inc.php` serializes into the shared `adminneo.version` cache. On later page loads, `design.inc.php` passes that cached value to `cookie()` and `rawurlencode()`, causing a `TypeError` rather than encoding a version string. A remote attacker can make the instance return HTTP 500 to all users for the cache's twenty-four-hour lifetime or until the poisoned cache is removed. Exploitation requires the web server to be able to write that shared cache; making it unwritable is an interim workaround. The issue retains the underlying type-validation defect reported previously in Adminer despite changes to AdminNeo's version-checking flow. This issue is fixed in version 5.5.0.","aliases":["GHSA-jm85-8cpp-9cjc"],"modified":"2026-10-31T10:46:12.436097307Z","published":"2026-10-30T18:53:04.957Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59978.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59978.json"},{"type":"FIX","url":"https://github.com/adminneo-org/adminneo/commit/b7ae929e6afb374f0a7aba3d73b7d441470ff907"},{"type":"WEB","url":"https://github.com/adminneo-org/adminneo/releases/tag/v5.5.0"},{"type":"ADVISORY","url":"https://github.com/adminneo-org/adminneo/security/advisories/GHSA-jm85-8cpp-9cjc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59978"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/adminneo-org/adminneo","events":[{"introduced":"7cb3e768bbd34f4b01aa9a2b7fac1c7224a02b37"},{"fixed":"d1eb8365876c441d35e9490d00ad4354fb6f6c20"},{"fixed":"b7ae929e6afb374f0a7aba3d73b7d441470ff907"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"4.6.2"},{"fixed":"5.5.0"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"b7ae929e6afb374f0a7aba3d73b7d441470ff907"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v5.5.0","range":[{"fixed":"d1eb8365876c441d35e9490d00ad4354fb6f6c20"}]}]}}],"versions":["v5.4.1","v5.4.0","v5.3.0","v5.2.1","v5.2.0","v5.1.1","v5.1.0","v5.0.0","v5.0.0-rc","v4.17.2","v4.17.1","v4.17.0","v4.16.1","v4.16.0","v4.15.0","v4.14.0","v4.13.0","v4.12.0","v4.11.0","v4.10.0","v4.9.4","v4.9.3","v4.9.2","v4.9.1","v4.9.0","v4.8.2","v4.8.1","v4.8.0","v4.7.9","v4.7.8","v4.7.7","v4.7.6","v4.7.5","v4.7.4","v4.7.3","v4.7.2","v4.7.1","v4.7.0","v4.6.3","v4.6.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59978.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}