CVE-2023-45197 is a critical file upload flaw in the Adminer and AdminerEvo file upload plugin, scored 9.8 by NVD. The record says AdminerEvo 4.8.3 fixes it and that Adminer is unsupported. Remove the plugin, update or replace the tool, and keep it off public networks.
What's affected
The NVD record says the file upload plugin in Adminer and AdminerEvo allows an attacker to upload a file using a table name of two dots, which places it in the root of the Adminer directory, where its name can be guessed and the file executed. The record was published on 2024-06-21.
NVD scores it 9.8, Critical, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The record says Adminer is no longer supported and the issue was fixed in AdminerEvo 4.8.3.
The fix commit, titled "Plugin file-upload generate temp filename no extension + prevent file to be located elsewhere then under upload path", changes the file upload plugin to create temporary names without extensions and to refuse files located outside the upload path. The v4.8.3 release is dated 29 October 2023. The release notes I read do not list this fix by name, so I rely on the record and the commit for the version.
Only installations that use the file upload plugin are described. The AdminerEvo repository is archived and read-only as of 24 January 2025.
Weakness class: CWE-22 (path traversal), CWE-434 (unrestricted file upload).
How to check if you're exposed
Search for Adminer files and for the plugin:
find / -iname "adminer*.php" 2>/dev/null
find / -path "*plugins*" -iname "file-upload.php" 2>/dev/null
The version is shown on the login page. If the file-upload plugin is present in a build older than AdminerEvo 4.8.3, treat the server as exposed. If the plugin is not loaded, the described path does not apply, but the tool should still not be public.
What to do now
- Find all Adminer and AdminerEvo deployments and note the version and whether the file upload plugin is enabled.
- Remove the file-upload plugin immediately where you do not need it.
- Upgrade to AdminerEvo 4.8.3 or later if you keep the tool, and then plan to replace it, because the project is archived.
- Take Adminer off public networks. Restrict it by address, VPN and authentication.
- Look at the Adminer directory and web root for unexpected files and check access logs for requests to them.
- Rotate database credentials used through Adminer if you find signs of misuse.
Why it matters
Two weaknesses combine here: path traversal (CWE-22) and unrestricted upload of a dangerous file type (CWE-434). The plugin trusts a name that can point outside the folder meant for uploads, and the uploaded file can then be run by the web server. That chain turns an upload form into code execution, which is why the score reaches 9.8.
Database tools on web servers carry the keys to the data. With no login needed according to the vector, the exposure is wide, and an unsupported project means the real fix is replacement. CVE-2023-45197 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay. The exploitability demo below shows how to weigh a score against the facts of your setup, and here the facts say the upload plugin and public reachability decide everything.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2023-45197?
The record says AdminerEvo 4.8.3. Adminer itself is unsupported.
Am I safe if I do not use the file upload plugin?
The described flaw is in that plugin, so it does not apply without it. Keep Adminer off public networks anyway.
Sources
Last reviewed: 19 October 2026.
