CVE-2026-121261

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121261", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-03T10:48:01.248Z", "datePublished": "2026-11-03T16:30:15.391Z", "dateUpdated": "2026-11-07T03:16:04.447Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-03T16:30:15.391Z"}, "title": "phpMyAdmin ShapeFile SHP File loadFromFile infinite loop", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-835", "lang": "en", "description": "Infinite Loop"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-404", "lang": "en", "description": "Denial of Service"}]}], "affected": [{"vendor": "phpMyAdmin", "product": "ShapeFile", "versions": [{"version": "4.0.0", "status": "affected"}, {"version": "4.0.1", "status": "affected"}], "cpes": ["cpe:2.3:a:phpmyadmin:shapefile:*:*:*:*:*:*:*:*"], "modules": ["SHP File Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-10-07T00:00:00.000Z", "lang": "en", "value": "Vulnerability found"}, {"time": "2026-11-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-03T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-03T16:51:11.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Ishan Oshada", "type": "finder"}, {"lang": "en", "value": "ishanoshada (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "ishanoshada (VulDB User)", "type": "analyst"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/430227", "name": "VDB-430227 | phpMyAdmin ShapeFile SHP File loadFromFile infinite loop", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/430227/cti", "name": "VDB-430227 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-121261", "name": "CVE-2026-121261 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1018488", "name": "Submit #1018488 | phpMyAdmin ShapeFile 4.0.1 CWE-835 -Infinite Loop in ShapeRecord::loadFromFile", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/Ishanoshada/efbda3b5bee92058cc6b08f67d4e7363", "tags": ["exploit"]}], "tags": ["x_open-source"], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-07T03:15:54.702805Z", "id": "CVE-2026-121261", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-07T03:16:04.447Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-121261", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-07T03:15:54.702805Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-07T03:15:59.871Z"}}], "cna": {"tags": ["x_open-source"], "title": "phpMyAdmin ShapeFile SHP File loadFromFile infinite loop", "credits": [{"lang": "en", "type": "finder", "value": "Ishan Oshada"}, {"lang": "en", "type": "reporter", "value": "ishanoshada (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "ishanoshada (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:phpmyadmin:shapefile:*:*:*:*:*:*:*:*"], "vendor": "phpMyAdmin", "modules": ["SHP File Handler"], "product": "ShapeFile", "versions": [{"status": "affected", "version": "4.0.0"}, {"status": "affected", "version": "4.0.1"}]}], "timeline": [{"lang": "en", "time": "2026-10-07T00:00:00.000Z", "value": "Vulnerability found"}, {"lang": "en", "time": "2026-11-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-11-03T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-11-03T16:51:11.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/430227", "name": "VDB-430227 | phpMyAdmin ShapeFile SHP File loadFromFile infinite loop", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/430227/cti", "name": "VDB-430227 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-121261", "name": "CVE-2026-121261 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1018488", "name": "Submit #1018488 | phpMyAdmin ShapeFile 4.0.1 CWE-835 -Infinite Loop in ShapeRecord::loadFromFile", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/Ishanoshada/efbda3b5bee92058cc6b08f67d4e7363", "tags": ["exploit"]}], "x_generator": ["VulDB PVTS v202611"], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "Infinite Loop"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "Denial of Service"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-03T16:30:15.391Z"}}}, "cveMetadata": {"cveId": "CVE-2026-121261", "state": "PUBLISHED", "dateUpdated": "2026-11-07T03:16:04.447Z", "dateReserved": "2026-11-03T10:48:01.248Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-11-03T16:30:15.391Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:phpmyadmin:shapefile:*:*:*:*:*:*:*:*"], "modules": ["SHP File Handler"], "product": "ShapeFile", "vendor": "phpMyAdmin", "versions": [{"status": "affected", "version": "4.0.0"}, {"status": "affected", "version": "4.0.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "id": "CVE-2026-121261", "lastModified": "2026-11-07T04:17:15.077", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-121261", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-07T03:15:54.702805Z", "version": "2.0.3"}}]}, "published": "2026-11-03T17:18:08.057", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/Ishanoshada/efbda3b5bee92058cc6b08f67d4e7363"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-121261"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1018488"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/430227"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/430227/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}, {"lang": "en", "value": "CWE-835"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "phpmyadmin/shapefile: phpMyAdmin ShapeFile: Denial of Service via infinite loop in ShapeRecord::loadFromFile", "id": "2566073", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566073"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-835", "details": ["A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "A flaw was found in phpMyAdmin ShapeFile. A remote attacker could exploit this vulnerability by providing a specially crafted shapefile for processing. When parsed by the ShapeRecord::loadFromFile function, the malicious input triggers an infinite loop, leading to excessive resource consumption and a Denial of Service (DoS)."], "name": "CVE-2026-121261", "public_date": "2026-11-03T16:30:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-121261\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-121261\nhttps://gist.github.com/Ishanoshada/efbda3b5bee92058cc6b08f67d4e7363\nhttps://vuldb.com/cve/CVE-2026-121261\nhttps://vuldb.com/submit/1018488\nhttps://vuldb.com/vuln/430227\nhttps://vuldb.com/vuln/430227/cti"], "statement": "This vulnerability is rated as Moderate impact because triggering the condition requires an application to ingest untrusted geographic vector data, confining the blast radius strictly to service availability through thread or process exhaustion. Red Hat products do not distribute the phpMyAdmin ShapeFile package by default, significantly limiting exposure in standard enterprise deployments. Furthermore, exploitation does not compromise system confidentiality or data integrity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.0.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ShapeFile", "source": "cna", "vendor": "phpMyAdmin"}, "product": "shapefile", "vendor": "phpmyadmin"}], "created": "2026-11-03T19:15:14.389213+00:00", "updated": "2026-11-06T21:41:03.963996+00:00", "vendors": ["phpmyadmin", "phpmyadmin$PRODUCT$shapefile"]}