CVE-2011-0986
phpMyAdmin allows remote attackers to obtain installation path via direct request for nonexistent file
phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.
Exploit likelihood
What each source reports
NVD Score used
phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.
- Record
CVE-2011-0986- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.
- Record
CVE-2011-0986- Updated
- 2026-11-02
EUVDEUVD-2011-0998 No score
phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.
- Record
EUVD-2011-0998- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wcmm-28rg-mg3r No score
phpMyAdmin allows remote attackers to obtain installation path via direct request for nonexistent file
phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.
- Record
GHSA-wcmm-28rg-mg3r- Weakness
- CWE-20, CWE-22
- Updated
- 2026-11-02
OSV No score
phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.
- Record
CVE-2011-0986- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-0986 No score
phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.
- Record
DEBIAN-CVE-2011-0986- Updated
- 2026-11-02
OSVGHSA-wcmm-28rg-mg3r No score
phpMyAdmin allows remote attackers to obtain installation path via direct request for nonexistent file
phpMyAdmin 2.11.x before 2.11.11.2, and 3.3.x before 3.3.9.1, does not properly handle the absence of the (1) README, (2) ChangeLog, and (3) LICENSE files, which allows remote attackers to obtain the installation path via a direct request for a nonexistent file.
- Record
GHSA-wcmm-28rg-mg3r- Weakness
- CWE-20, CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpmyadmin/phpmyadminPackagist |
2.11.0 up to 2.11.11.2 | 2.11.11.2 |
phpmyadmin/phpmyadminPackagist |
3.3.0 up to 3.3.9.1 | 3.3.9.1 |
phpmyadminDebian:12 |
before 4:3.3.9.2-1 | 4:3.3.9.2-1 |
phpmyadminDebian:13 |
before 4:3.3.9.2-1 | 4:3.3.9.2-1 |
phpmyadminDebian:14 |
before 4:3.3.9.2-1 | 4:3.3.9.2-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-0986 is a medium vulnerability (CVSS 5.0) in Phpmyadmin, published February 14, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. Fixed in phpmyadmin/phpmyadmin 2.11.11.2.
References
exchange.xforce.ibmcloud.com/vulnerabilities/65424
phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=035d002db1e1201e73e560d7d98591563b506a83
vupen.com/english/advisories/2011/0385
lists.fedoraproject.org/pipermail/package-announce/2011-February/054355.html
mandriva.com/security/advisories?name=MDVSA-2011:026
Show 7 moreShow less
phpmyadmin.net/home_page/security/PMASA-2011-1.php
secunia.com/advisories/43478
nvd.nist.gov/vuln/detail/CVE-2011-0986
github.com/advisories/GHSA-wcmm-28rg-mg3r
security-tracker.debian.org/tracker/CVE-2011-0986