pgAdmin 4 vulnerabilities

There is a path traversal vulnerability using symbolic links in pgAdmin 4 File Manager. An authenticated user can create a symbolic link in their directory pointing outside of it, allowing data to be written to any path accessible by the pgAdmin process.

In pgAdmin 4 FileBackedSessionManager, there is a vulnerability to deserialization of untrusted data, which can lead to remote code execution at the operating system level. This issue arises from the lack of proper integrity checks before deserializing session file contents.

In pgAdmin 4 before version 9.15, there is an OS command injection vulnerability (CWE-78) in the Import/Export query export feature. An authenticated user could inject malicious commands, leading to arbitrary command execution on the pgAdmin server or arbitrary file writes.

A SQL injection vulnerability in the pgAdmin 4 Maintenance Tool allows an authenticated user with tools_maintenance permissions to execute arbitrary SQL commands on the PostgreSQL server. Exploiting this vulnerability could lead to privilege escalation and execution of operating system commands on the database host.

A vulnerability in pgAdmin 4 allows remote code execution (RCE) via injection into the Import/Export Data tool. The validation function incorrectly handles backslashes in SQL strings, enabling bypass of protections and addition of a TO PROGRAM clause to psql commands.

A vulnerability in pgAdmin 4 (versions 9.13 to 9.16) allows bypassing the CVE-2026-12045 fix by injecting SQL queries into the AI assistant. An attacker can plant a malicious payload in an object read by the assistant, leading to execution of multiple SQL statements, including write or remote code execution.

In the adhoc_connect_server function in pgAdmin 4 9.0-9.16, when a non-owner user clones a server, all columns including credentials (passwords) and ownership flags are copied. This allows an attacker to take over the cloned server and use database passwords belonging to another user (e.g., an administrator).

A stored cross-site scripting vulnerability exists in pgAdmin 4 versions 6.0 through 9.15. Text returned by a PostgreSQL server (e.g., object names in errors or EXPLAIN fields) was passed verbatim to html-react-parser, allowing injection of arbitrary HTML, including iframes. An attacker controlling the server or creating a maliciously named object can hijack the victim's pgAdmin session.

In pgAdmin 4 versions 6.9 through 9.15, two SQL Editor endpoints lack authentication decorators, allowing unauthenticated attackers to trigger pickle deserialization from server sessions. Exploitation requires additional preconditions (knowledge of SECRET_KEY and write access to sessions directory) to achieve remote code execution.

A vulnerability in the pgAdmin 4 AI Assistant allows an attacker who can influence database content read by the assistant to execute arbitrary SQL with the privileges of the pgAdmin user's database role. The flaw stems from missing validation of LLM-generated queries, enabling bypass of read-only mode via injection of commands like COMMIT or ROLLBACK.

Authorization vulnerability in pgAdmin 4 server mode allows access to private objects of other users without proper filtering. An authenticated user could access another user's private servers, server groups, and background processes by guessing object IDs.

pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin.

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability when running in server mode and performing restores from PLAIN-format dump files. Attackers can inject and execute arbitrary commands on the server hosting pgAdmin.

The role-based tool permission system in pgAdmin 4 (versions 9.3-9.17) lacked consistent enforcement. The permissions_required decorator was applied only to the main route of each tool, while other backend routes and Socket.IO handlers only checked authentication, not the specific tool permission. This allowed an authenticated user without the required permission to fully use the tool (e.g., psql, backup, restore) via alternative paths.

pgAdmin 4 in SERVER mode has a vulnerability where some routes lack required authentication. An unauthenticated network client can enumerate constraint metadata, delete table constraints, read preference values, and force-close debugger or schema-diff sessions belonging to other users.

In pgAdmin 4 from version 7.2 before 9.17, the MASTER_PASSWORD_HOOK setting allowed shell command injection via a username containing shell metacharacters (e.g., ';', '$()', backticks). The username from external auth sources (OAuth, Kerberos) could be used to execute arbitrary commands as the pgAdmin service account.

A vulnerability in pgAdmin 4 allows SQL injection via improper escaping of object names in query templates. A low-privileged user can create an object with an apostrophe in its name, which when another user opens the Statistics or Dependencies tab leads to arbitrary SQL execution in the database session.

SQL injection vulnerability in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint.

Open redirect vulnerability in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honored the user-supplied 'next' parameter without confirming the target points back to pgAdmin, allowing an authenticated user to be redirected to an external attacker-controlled host.

HTML injection vulnerability in pgAdmin 4's cloud module allows injecting HTML code via crafted credentials. The flaw exists in /rds/, /azure/, /google/, and /cloud/ endpoints where SDK error messages are returned in JSON without HTML encoding, then rendered by the Cloud Wizard frontend. An authenticated user can inject a malicious iframe that redirects the victim to an external site.

SQL injection vulnerability in pgAdmin 4 affects sixteen Jinja templates where user-supplied descriptions are directly interpolated into SQL literals without proper escaping. An authenticated user with permissions to create or alter objects (domains, foreign tables, languages, event triggers) can inject arbitrary SQL commands, potentially leading to OS command execution if the PostgreSQL role has superuser privileges.