CVE-2026-116243 in pgAdmin 4
Summary
by MITRE • 10/30/2026
pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory (STORAGE_DIR), not under a SHARED_STORAGE directory, which ordinary users can upload files to. A user could therefore upload an executable to shared storage, point their binary path at it, and have pgAdmin run it as the operating-system account running pgAdmin. On POSIX, files created through pgAdmin are not executable, so this is exploitable where any file with an executable name can run, such as Windows server mode.
The fix checks the binary path against every SHARED_STORAGE directory as well, after expanding $DIR, collapsing ".." and resolving symbolic links, compares directories in a way a different spelling on a case-insensitive filesystem cannot bypass, refuses a path containing a NUL, and enforces the check wherever binary paths are resolved, including for the PSQL tool.
This issue affects pgAdmin 4: before 9.19.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in pgAdmin 4 prior to version 9.19 represents a critical server-side path traversal and arbitrary command execution flaw rooted in insufficient validation of user-supplied binary paths. In its default configuration, the application allows users to specify custom paths for external database utilities such as pg_dump, pg_restore, pg_dumpall, and psql within their preferences. The core technical failure lies in the logic used to validate these paths during server mode operations. Previously, the security check was narrowly scoped, refusing access only if the specified binary path resided under a per-user storage directory known as STORAGE_DIR. However, this validation mechanism failed to extend its scrutiny to SHARED_STORAGE directories, which are accessible for file uploads by ordinary authenticated users. This architectural oversight created a significant attack vector where an attacker could upload a malicious executable script or binary into a shared storage location and subsequently configure pgAdmin to execute that path.
The operational impact of this vulnerability is severe, as it leads to remote code execution with the privileges of the operating system account running the pgAdmin server process. On POSIX-compliant systems, files created through standard file upload mechanisms typically lack executable permissions by default, which may mitigate exploitation in some specific Linux or Unix environments unless an attacker can leverage other means to set execute bits. However, on Windows servers and potentially other platforms where execution restrictions are less stringent for uploaded content, this flaw is directly exploitable. An authenticated user with the ability to upload files to shared storage can place a malicious payload there, point their pgAdmin configuration at that location, and trigger its execution when performing database operations or tool invocations within the application interface. This effectively bypasses authentication controls by leveraging legitimate administrative functions to execute arbitrary code under high-privilege contexts.
The remediation implemented in version 9.19 addresses these deficiencies through a comprehensive hardening of path validation logic. The fix expands the scope of directory checks to include every SHARED_STORAGE directory, ensuring that no user-writable location can be used as an execution source for system binaries. Crucially, the new implementation performs rigorous normalization of file paths before comparison. This process involves expanding environment variables such as $DIR, collapsing relative path components like ".." to prevent traversal attacks, and resolving symbolic links to ensure the final target is accurately identified. Furthermore, the validation logic employs case-insensitive directory comparison techniques that are resistant to bypass attempts using different character casing on case-insensitive filesystems. The patch also introduces strict rejection of paths containing NUL bytes, which can sometimes be used in buffer overflow or injection attacks across various operating systems and programming languages.
This security enhancement is applied consistently across all components where binary paths are resolved, including the PSQL tool integration, ensuring that no entry point remains vulnerable to this class of attack. By enforcing these checks uniformly, pgAdmin 4 eliminates the possibility of an attacker leveraging shared storage areas for privilege escalation or arbitrary code execution. This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). From a threat modeling perspective, this flaw facilitates the ATT&CK technique T1059.004: Unix Shell Commands, allowing attackers to execute system-level commands through application interfaces that should be restricted to safe operations. Organizations running pgAdmin 4 versions prior to 9.19 must upgrade immediately to mitigate the risk of unauthorized code execution and potential full server compromise via this path validation weakness.