---
id: CVE-2026-119428
title: phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
summary: >-
  phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability
  that allows unauthenticated attackers to trigger outbound connections via
  setup/validate.php, which lacks the setup-disabled guard. Attackers can POST
  attacker…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: phpMyAdmin
product: phpMyAdmin
affected:
  - phpMyAdmin <= 5.2.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:17:37.881440Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:17:53.977Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119428'
references:
  - url: >-
      https://github.com/phpmyadmin/phpmyadmin/commit/510e442593af5d4702bbb46cdb45ad51f3a8a9d3
  - url: >-
      https://github.com/phpmyadmin/phpmyadmin/commit/126ac3ac5662ed3171ef3646636348fad3f8e952
  - url: 'https://github.com/phpmyadmin/phpmyadmin/pull/19156'
  - url: >-
      https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/setup/validate.php#L21-L35
  - url: >-
      https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Config/Validator.php#L241
  - url: 'https://abraxaslabs.tech/research/phpmyadmin-setup-validate'
  - url: 'https://github.com/phpmyadmin/phpmyadmin'
  - url: >-
      https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-ssrf-via-setup-validate-php-after-setup-disabled
    label: >-
      VulnCheck Advisory: phpMyAdmin through 5.2.3 SSRF via setup/validate.php
      After Setup Disabled
tags:
  - cve.org
  - exploit-available
epss: 0.0034
epssPercentile: 0.2758
ingestedAt: '2026-11-03T11:43:15.770Z'
---

## Overview

phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages.

## Affected

- `phpMyAdmin <= 5.2.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.