CVE-2026-15686

CVE-2026-15686 is a code execution vulnerability in Adminer stemming from improper handling of mysqli_multi_query's return values. The bug itself is straightforward: the code fails to distinguish between FALSE (error), TRUE (successful non-SELECT query), and a result object (successful SELECT). This three-state return pattern has been a documented source of vulnerabilities in PHP applications for over a decade—CVE-2012-0906, CVE-2012-5381, CVE-2013-1420, and numerous others share this root cause. The fact that systematic analysis tools continue finding this exact pattern confirms it's not an isolated coding error but a vulnerability genotype that expresses across PHP codebases wherever multi_query meets time pressure or maintenance turnover. The critical insight here is that mysqli's API design actively rewards incorrect handling in common paths. With mysqli_query(), the shortcut `if ($result)` works correctly: FALSE evaluates false, result objects evaluate true. Developers internalize this pattern, then apply it to multi_query where it silently fails—TRUE from an INSERT/UPDATE enters the processing block expecting a result object, and the vulnerability becomes exploitable through subsequent uninitialized variable use or type confusion. This isn't developer sloppiness; it's an API that breaks the mental model its own success trained. For defenders: audit your codebase for any mysqli_multi_query calls and verify they check for FALSE first, then branch on the result type. If you're using Adminer, this CVE should trigger a broader review—multi_query typically appears in bulk operations, data imports, or admin functions where developers are most likely to have copied patterns from example code. The mysqli manual's examples have historically used simplified error handling that works for single queries but breaks for multi_query; audit your code against the current documentation, not historical Stack Overflow copies. On severity: the CVSS 7.2 with 'authentication required' deserves skepticism in practice. Adminer is deployed specifically for convenience over security tooling; users who choose it over proper database tools often disable authentication for local development and forget to re-enable it in production. The authentication barrier is real in principle but weak in practice for a tool whose appeal is ease of deployment outside proper access controls. Treat this as exploitable in more environments than the CVSS suggests. The remediation timeline matters. Redesigning mysqli's return semantics or deprecating multi_query would take years of RFC debates and ecosystem migration. Adminer can ship a patch in a release cycle. Prioritize the immediate Adminer patch while auditing your own code for the same pattern—that's where the exposure window actually closes.

Reviewed through automated stages and approved by a human before publication.