---
id: CVE-2026-121261
title: phpMyAdmin ShapeFile SHP File loadFromFile infinite loop
summary: >-
  A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted
  is the function ShapeRecord::loadFromFile of the component SHP File Handler.
  Such manipulation leads to infinite loop. The attack can be executed remotely.
  The …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-835
  - CWE-404
vendor: phpMyAdmin
product: ShapeFile
affected:
  - ShapeFile 4.0.0
  - ShapeFile 4.0.1
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T16:30:15.391Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121261'
references:
  - url: 'https://vuldb.com/vuln/430227'
    label: VDB-430227 | phpMyAdmin ShapeFile SHP File loadFromFile infinite loop
  - url: 'https://vuldb.com/vuln/430227/cti'
    label: 'VDB-430227 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-121261'
    label: CVE-2026-121261 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1018488'
    label: >-
      Submit #1018488 | phpMyAdmin ShapeFile 4.0.1 CWE-835 -Infinite Loop in
      ShapeRecord::loadFromFile
  - url: 'https://gist.github.com/Ishanoshada/efbda3b5bee92058cc6b08f67d4e7363'
tags:
  - cve.org
epss: 0.00293
epssPercentile: 0.22089
ingestedAt: '2026-11-05T20:33:06.282Z'
---

## Overview

A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `ShapeFile 4.0.0`
- `ShapeFile 4.0.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.