phpmyadmin/phpmyadmin · critical · ConfigException

Wrong permissions on configuration file, should not be…

Error message

Wrong permissions on configuration file, should not be world writable!

What it means

As a security hardening measure, Config::checkPermissions rejects a configuration file whose permissions are world-writable (world-write permission bits set), because anyone on the host could modify config.inc.php and thus compromise phpMyAdmin. On Windows the check is skipped. The message tells the operator to tighten the file mode.

Solutions

1. chmod 640 (or 644) config.inc.php to remove world-write, owned by the PHP user
2. Fix the provisioning/copy step that applied world-writable permissions
3. Check the containing directory permissions too and remove group/world write there
4. Re-run the phpMyAdmin setup or page load to confirm the check passes

Example fix

// before
-rwxrwxrwx config.inc.php
// after
chmod 640 config.inc.php

$perms = fileperms('config.inc.php'); if ($perms & 0x0002) { chmod('config.inc.php', 0640); }

try { $config->loadFromFile($path); } catch (ConfigException $e) { if (str_contains($e->getMessage(), 'world writable')) { chmod($path, 0640); $config->loadFromFile($path); } }

When it happens

Trigger: Calling checkPermissions() (part of the load flow on non-Windows systems) when stat(config.inc.php) shows the world-writable bit set, e.g. file mode 0777 or 0666.

Common situations: Running `chmod 777` to 'fix' a permissions problem, copying config.inc.php from a FAT/USB filesystem or extraction tool that set 0777, or provisioning scripts with umask 000.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Existing configuration file
• Can not find signon authentication script
• Configuration option
• Configuration option
• Failed to generate random CSRF token!

AI-assisted analysis of phpmyadmin/phpmyadmin@70d713dc39 (2026-09-13). Data as JSON: /api/errors/65ab7fb168914cec. Report an issue: GitHub.

Appendix: source

Thrown at src/Config.php:279

     */
    public function checkPermissions(): void
    {
        // Check for permissions (on platforms that support it):
        if (! $this->config->CheckConfigurationPermissions || ! @file_exists($this->source)) {
            return;
        }

        $perms = @fileperms($this->source);
        if ($perms === false || ! ($perms & 2)) {
            return;
        }

        // This check is normally done after loading configuration
        if ($this->isWindows()) {
            return;
        }

        throw new ConfigException(__('Wrong permissions on configuration file, should not be world writable!'));
    }

    /**
     * sets configuration variable
     *
     * @param string $setting configuration option
     * @param mixed  $value   new value for configuration option
     *
     * @throws ConfigException
     */
    public function set(string $setting, mixed $value): void
    {
        $parts = explode('/', $setting);
        if (! $this->setValueRecursive($this->settings, $parts, $value)) {
            return;
        }

        $this->config = new Settings($this->settings);

View on GitHub (pinned to 70d713dc39)