CVE-2026-119428phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

Description

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://github.com/phpmyadmin/phpmyadmin/commit/510e442593af5d4702bbb46cdb45ad51f3a8a9d3 patchPatch
• https://github.com/phpmyadmin/phpmyadmin/commit/126ac3ac5662ed3171ef3646636348fad3f8e952 patchPatch
• https://github.com/phpmyadmin/phpmyadmin/pull/19156 patchissue-trackingPatch
• https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/setup/validate.php#L21-L35 technical-descriptionProduct
• https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Config/Validator.php#L241 technical-descriptionProduct
• https://abraxaslabs.tech/research/phpmyadmin-setup-validate third-party-advisoryExploitThird Party Advisory
• https://github.com/phpmyadmin/phpmyadmin productProduct
• VulnCheck Advisory: phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled third-party-advisoryExploitPatchThird Party Advisory