CVE-2016-9853
Status: ModifiedMedium (5.3)—
An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the fopen wrapper issue.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Base score: 5.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 2.54%
- Percentile among all scored CVEs: 85
- Score date: 10/8/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-200
References
Raw JSON (NVD)
Show
{
"id": "CVE-2016-9853",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 5.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2016-12-11T02:59:51.477",
"references": [
{
"url": "http://www.securityfocus.com/bid/94527",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "cve@mitre.org"
},
{
"url": "https://security.gentoo.org/glsa/201701-32",
"source": "cve@mitre.org"
},
{
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/94527",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.gentoo.org/glsa/201701-32",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.phpmyadmin.net/security/PMASA-2016-63",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the fopen wrapper issue."
},
{
"lang": "es",
"value": "Se descubrió un problema en phpMyAdmin. Llamando a algunas secuencias de comandos que son parte de phpMyAdmin de forma inesperada, es posible desencadenar phpMyAdmin para mostrar un mensaje de error de PHP que contiene la ruta completa del directorio donde phpMyAdmin está instalado. Durante un tiempo de espera de ejecución en la funcionalidad de exportación, los errores que contienen la ruta completa del directorio de phpMyAdmin se escriben en el archivo de exportación. Todas las versiones 4.6.x (anteriores a 4.6.5) y versiones 4.4.x (anteriores a 4.4.15.9) están afectadas. Esta CVE es para el problema del fopen wrapper."
}
],
"lastModified": "2026-06-17T00:56:40.413",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "13CD0228-728B-437A-84C1-BD7AFA52FFB5"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFF55485-9892-4E7B-AEE0-017E61EAA7C0"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6100FE3E-0A31-4B55-90F2-90AF765A8EB7"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FBAAC8D9-AAA5-487C-B4AA-84BAE5DB109E"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E06B1D3-29B4-45B7-B81F-C864AF579011"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6B2E3923-0E2B-411A-B091-088E6FF050D0"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1848C748-804D-4FE4-AB9C-B1BF9E58A19C"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "12296322-DFAD-4B36-83EC-D01BF5DF7F2A"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EA321C14-C8F4-41FC-B601-2F646064ABBF"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54DBCF86-0CE8-46C4-B2E7-E3224765CCFE"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1BF3DBC5-7020-48D0-ADEA-E71776DB2285"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "317F952E-5F12-4ED3-8FA3-FC1106B50F85"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "87B97F98-C0A7-4D9E-8333-7EE9EC456A12"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7A1E753D-5653-4D7A-8E41-6C02511EBFCE"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.12:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "417230C7-0EC2-49F4-B810-A8AE84A302AD"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "103FEAB1-194E-4CEF-935A-4DBCCA298205"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.13.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C5814003-9FF8-4F8E-9D90-A2BBB80B8451"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C6D742A8-B9D0-4BC0-8E3E-E0FDCC1083FE"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.14.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "16D28B77-9353-4259-9299-30638A78CCD4"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C022292B-6E06-4328-842F-135A872D22AF"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F15F00FB-BB9B-4D54-B198-0A74D418B8DE"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC10AF20-7B65-4FAE-A2AD-783867D60A8D"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4EB7190C-0401-4E2E-B15F-4CFC79D5A4E7"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4BED20D9-C571-4BC5-9A54-450A364C6E43"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2A2B646D-DDFC-4CB2-B7F4-0C33AF18D14F"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9CBF68B2-2BCF-4EEB-8A7C-D83DCAF1AFB4"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36B92C51-B51B-4538-8A2A-102881F8024C"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.4.15.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "74C191A5-3316-4A34-8B37-64D6DD616CEF"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C641F362-D37D-47CB-BE6C-36E5F116F844"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85631B69-7060-42D1-AE24-466BA10EB390"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E62EDC79-47AA-4CED-AB7F-1E4D158EB653"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0B800AA-6290-4032-AA17-21025A19C392"
},
{
"criteria": "cpe:2.3:a:phpmyadmin:phpmyadmin:4.6.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "230D3D61-B090-49FA-91B1-9FA4DD2C6209"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}