An authenticated path traversal vulnerability in Adminer versions before 5.4.3 allows attackers to perform arbitrary file deletions, potentially leading to service disruption.

This is a path traversal vulnerability (CWE-22) occurring within SQLite functionality. The vulnerability requires the attacker to have authenticated access to the Adminer interface to trigger the deletion of arbitrary files on the host system.

Successful exploitation allows an authenticated attacker to delete critical files, which can result in significant system downtime or loss of data integrity. With a CVSS score of 8.1, the high potential for impact on availability and system stability necessitates prompt remediation, especially in environments where multiple users have access to the database management interface.

Immediate Action: Upgrade Adminer to version 5.4.3 or later to remediate the directory traversal flaw.

Proactive Monitoring: Monitor database management logs for unexpected file system operations or suspicious administrative activity.

Compensating Controls: Restrict access to the Adminer interface to trusted IP addresses and enforce strong authentication to limit the pool of potential attackers.

Public Exploit Available: No

While this vulnerability requires authentication, the potential for destructive file system impact is high. Administrators should apply the update to version 5.4.3 immediately to prevent unauthorized file deletion and ensure the continued availability of the database management environment.