CVE-2026-86861
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In pgAdmin 4, the File Manager save_file endpoint validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call, without O_NOFOLLOW. As a result, if the final path component was replaced with a symbolic link in the interval between the check and the write, the write followed the link and could create or overwrite an arbitrary file as the operating-system account running pgAdmin. This affects pgAdmin 4 from the introduction of the containment check in the File Manager save path before 9.18.
Risk Assessment
Exploitation requires the ability to create or replace a symbolic link inside the requesting user's storage directory and to win the timing window between the check and the write, which typically means filesystem access to the pgAdmin host or to a shared or network-mounted storage backend. The impact can be creation or overwrite of an arbitrary file as the operating-system account running pgAdmin, potentially leading to privilege escalation or further compromise.
Recommendation
Update pgAdmin 4 to version 9.18 or later, which routes save_file's write through the same O_NOFOLLOW-protected helper used by the upload path and explicitly reports a symbolic-link refusal. Restrict filesystem access to the pgAdmin host and to any shared or network-mounted storage backend to trusted accounts only.
Other vulnerabilities in pgAdmin 4
See all- CVE-2026-116241Critical
pgAdmin 4 before 9.19 contains a bypass of the CVE-2026-17566 fix in the Import/Export Data tool. Improper validation of a backslash inside a double-quoted identifier hides a closing parenthesis and executes a TO PROGRAM clause via psql on the pgAdmin host with the OS account privileges.
- CVE-2026-86863Critical
In pgAdmin 4, the 'webserver' authentication source was vulnerable because WebserverAuthentication.get_user() fell back to reading the username directly from inbound HTTP request headers when the WSGI/CGI environment lookup returned nothing. As a result, any client able to reach pgAdmin could supply that header itself and authenticate as any username, including an existing Administrator, without a password. The issue affects versions from 6.2 before 9.18 and only applies when 'webserver' is enabled in AUTHENTICATION_SOURCES.
- CVE-2026-17566Critical
A vulnerability in pgAdmin 4 allows remote code execution (RCE) via injection into the Import/Export Data tool. The validation function incorrectly handles backslashes in SQL strings, enabling bypass of protections and addition of a TO PROGRAM clause to psql commands.
- CVE-2026-17351Critical
A vulnerability in pgAdmin 4 (versions 9.13 to 9.16) allows bypassing the CVE-2026-12045 fix by injecting SQL queries into the AI assistant. An attacker can plant a malicious payload in an object read by the assistant, leading to execution of multiple SQL statements, including write or remote code execution.
- CVE-2026-17349Critical
In the adhoc_connect_server function in pgAdmin 4 9.0-9.16, when a non-owner user clones a server, all columns including credentials (passwords) and ownership flags are copied. This allows an attacker to take over the cloned server and use database passwords belonging to another user (e.g., an administrator).
- CVE-2026-12048Critical
A stored cross-site scripting vulnerability exists in pgAdmin 4 versions 6.0 through 9.15. Text returned by a PostgreSQL server (e.g., object names in errors or EXPLAIN fields) was passed verbatim to html-react-parser, allowing injection of arbitrary HTML, including iframes. An attacker controlling the server or creating a maliciously named object can hijack the victim's pgAdmin session.
- CVE-2026-12046Critical
In pgAdmin 4 versions 6.9 through 9.15, two SQL Editor endpoints lack authentication decorators, allowing unauthenticated attackers to trigger pickle deserialization from server sessions. Exploitation requires additional preconditions (knowledge of SECRET_KEY and write access to sessions directory) to achieve remote code execution.
- CVE-2026-12045Critical
A vulnerability in the pgAdmin 4 AI Assistant allows an attacker who can influence database content read by the assistant to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The flaw stems from missing validation of LLM-generated queries, enabling bypass of read-only mode via injection of commands like COMMIT or ROLLBACK.
- CVE-2026-7813Critical
In pgAdmin 4 server mode, multiple endpoints fetched user-owned objects without filtering by the requesting user's identity, allowing an authenticated user to access another user's private servers, server groups, background processes, and debugger arguments by guessing object IDs. The Shared Servers feature had additional issues including credential leakage, privilege escalation via writable passexec_cmd enabling arbitrary command execution, and owner-data corruption.
- CVE-2025-13780Critical
pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin.
Original NVD description (English source)
pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-7819 had previously hardened the separate file upload path by opening its target with O_NOFOLLOW, so that the kernel refuses to follow a symbolic link at the final path component, but save_file was left on an unprotected open(). A symbolic link already present when the check ran was rejected by the check itself; the remaining exposure was a link substituted at the final path component in the interval between the check and the write, at which point the write followed the link and landed outside the user's storage directory, creating or overwriting an arbitrary file as the operating-system account running pgAdmin. Exploitation requires the ability to create or replace a symbolic link inside the requesting user's storage directory. pgAdmin exposes no interface that creates symbolic links, so this requires filesystem access to the pgAdmin host or to a shared or network-mounted storage backend, together with winning the timing window. The reporter did not achieve a write against a released version, having attempted approximately 63,000 racing requests without success; the reported defect is the uncovered write path rather than a demonstrated sandbox escape. The fix routes save_file's write through the same O_NOFOLLOW-protected helper already used by the upload path, so both File Manager write sinks carry identical kernel-enforced protection, and reports a symbolic-link refusal explicitly instead of surfacing the underlying system error text. Note that files created by save_file are now given mode 0600, inheriting the behaviour introduced for uploads. The protection covers the final path component; substitution of an intermediate directory component is not addressed by this change. This issue affects pgAdmin 4: from the introduction of the containment check in the File Manager save path before 9.18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS