{"action":"Upgrade adminer to 6.0.0-1 or later.","affected":[{"fixed":"6.0.0-1","introduced":"0"}],"component":"adminer","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["6.0.0-1"],"id":"tcs_01M5NRT0T5F2SDTAM2Z3S2PENJ","modified_at":"2026-10-13T10:00:10.405604987Z","published_at":"2026-08-25T02:16:40.400Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-34959","https://security-tracker.debian.org/tracker/CVE-2026-34959"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-34959#Debian:14/adminer","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-34959"}],"summary":"Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER[\"REQUEST_URI\"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply a"}