CVE-2026-59978

### Summary AdminNeo v5.4.1 gets the latest version from GitHub API in a browser JavaScript function. Version number is then sent by POST request to `?script=version`. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST `version[]` parameter which PHP converts to an array. On next page load, function `rawurlencode()` receives this array instead of string and throws `TypeError`, returning HTTP 500 to all users for the next 24 hours. Originally reported by @JoyGhoshs in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh Although the version checking process was modified in AdminNeo, the root cause persisted. ### Workaround If you can't upgrade, make the file `adminneo.version` in temp directory (usually the value of [upload_tmp_dir](https://www.php.net/ini.core#ini.upload-tmp-dir)) unwritable by web server. ### Details #### 1. Intended design of `?script=version` The endpoint is designed to receive version data from GitHub via browser JavaScript. - `functions.js` line 110-121: Receives the latest release information from GitHub API by AJAX. - JavaScript POSTs version number to `?script=version`. - Server stores version number in `/tmp/adminneo.version` file that is used as a shared cache for all users in the same server for the next 24 hours. ```js // function.js lines 119-120 const data = 'version=' + version + '&token=' + token; ajax(baseUrl + 'script=version', null, data); ``` #### 2. The vulnerability The endpoint only checks `$_GET["script"] == "version"` - it does not validate: - Request origin (CSRF token is present, but not checked for this endpoint) - Request source (any HTTP client can POST) - Parameter types (`version` expected as string, array not rejected) ```php // bootstrap.inc.php lines 44-53 if ($_GET["script"] == "version") { $filename = get_temp_dir() . "/adminneo.version"; @unlink($filename); // It may not be writable by us, @ - it may not exist. $file = open_fi