Description
Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guard (bootstrap.inc.php) only rejects prefixes matching ^/[^/], blocking //evil.com but allowing values such as /\evil.com whose second character is a backslash. Because browsers normalize backslash to forward slash, a network-path reference survives into REQUEST_URI and reaches cookie_path(), affecting the Set-Cookie Path attribute. Exploitation requires that clients can set the X-Forwarded-Prefix header (a misconfigured or absent reverse proxy). Impact is limited to anomalous cookie-path scoping.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| vrana | adminer | < 5.5.1 | 5.5.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | adminer | 6.0.0-1 | — |
| Debian 13 | adminer | No fix yet | — |
| Debian 12 | adminer | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | adminer | No fix yet | — |
| Ubuntu 24.04 LTS | adminer | No fix yet | — |
| Ubuntu 22.04 LTS | adminer | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | adminer | No fix yet | — |
| Ubuntu Pro 18.04 LTS | adminer | No fix yet | — |
| Ubuntu Pro 16.04 LTS | adminer | No fix yet | — |
References
- GitHub Security Advisory (GHSA-fr74-9mf9-gf44) vendor-advisory
- VulnCheck Advisory: Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass third-party-advisory