Description
Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta->name][transformation] parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | phpmyadmin | 4:3.4.3.1-1 | — |
| Debian 13 | phpmyadmin | 4:3.4.3.1-1 | — |
| Debian 12 | phpmyadmin | 4:3.4.3.1-1 | — |
| Debian 6.0 | phpmyadmin | 4:3.3.7-6 | DSA-2286-1 |
| Debian 5.0 | phpmyadmin | 4:2.11.8.1-5+lenny9 | DSA-2286-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpmyadmin/phpmyadmin | >= 3.3.0, < 3.3.10.2 | 3.3.10.2 | GHSA-q6vw-39cg-wjjf |
| Packagist | phpmyadmin/phpmyadmin | >= 3.4.0, < 3.4.3.1 | 3.4.3.1 | GHSA-q6vw-39cg-wjjf |
Advisories 1
- DSA-2286-1 phpymadmin - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.xxor.se/advisories/phpMyAdmin_3.x_Multiple_Remote_Code_Executions.txt
- [oss-security] 20110628 CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- http://typo3.org/teams/security/security-bulletins/typo3-sa-2011-008/
- http://www.phpmyadmin.net/home_page/security/PMASA-2011-8.php
- 45292 third-party-advisory
- [oss-security] 20110628 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- [oss-security] 20110628 Re: [Phpmyadmin-security] CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- 73614 vdb-entry
- MDVSA-2011:124 vendor-advisory
- 8306 third-party-advisory
- 45139 third-party-advisory
- http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=b434320eff8ca9c2fc1b043c1804f868341af9a7
- DSA-2286 vendor-advisory
- 20110707 phpMyAdmin 3.x Multiple Remote Code Executions mailing-list
- [oss-security] 20110629 Re: CVE Request: phpMyAdmin 3.4 Multiple Vulnerabilities mailing-list
- http://ha.xxor.se/2011/07/phpmyadmin-3x-multiple-remote-code.html
- 45315 third-party-advisory
- FEDORA-2011-9144 vendor-advisory