CVE-2026-116250 in pgAdmin
Summary
by MITRE • 10/30/2026
In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it with a plain open() or handed the path to a utility that opened it later: the servers.json export and import and the import file listing, and the files given to pg_dump, pg_dumpall, pg_restore and psql by Backup, Restore and Import/Export Data. A symbolic link swapped in at the file or at any parent directory between the check and the open redirected the operation outside the storage directory, so a file could be written, overwritten or read, or loaded into a table, as the operating-system account running pgAdmin. A hard link to an outside file, which O_NOFOLLOW does not detect, and a FIFO, which could hang a request, had the same effect. CVE-2026-86861 fixed this for the File Manager's save_file; these were the remaining paths.
Exploitation requires creating such a link or FIFO inside the user's storage directory. pgAdmin offers no way to do so, and the per-user storage directories belong to the pgAdmin account, so this requires write access to the storage backend as a different operating-system user, for example a shared or network-mounted storage directory, and winning the race.
The fix opens each file by walking down from the storage directory one component at a time with O_NOFOLLOW, accepting only a regular file with one link, and passes the utilities the open descriptor (/dev/fd/N) on Linux. Error messages no longer include the server path.
This issue affects pgAdmin 4: before 9.19.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified as CVE-2026-86861 represents a critical directory traversal and race condition flaw within the file handling mechanisms of pgAdmin 4 when operating in server mode. The core technical deficiency lies in the sequence of operations performed by the check_access_permission function followed by subsequent file open calls using standard system utilities or direct Python open() functions. This implementation creates a time-of-check to time-of-use (TOCTOU) window where an attacker can manipulate filesystem objects between the initial permission validation and the actual file access operation. Specifically, if a symbolic link is created at the target filename or any parent directory within the user's storage path after the check but before the open call, the operating system resolves the link to its final destination outside the intended sandboxed storage directory. This allows an attacker with sufficient privileges to read sensitive configuration files, overwrite critical application data, or inject malicious content into database tables via utilities like pg_dump and psql that are invoked by the Backup, Restore, and Import/Export Data features.
Beyond symbolic links, the vulnerability extends to hard links and named pipes (FIFOs), which bypass standard symlink detection mechanisms such as O_NOFOLLOW when applied incorrectly or not at all during specific operations. Hard links allow an attacker to point a file within the storage directory to any existing file on the system that they have write access to, effectively granting read-write permissions to arbitrary files without needing to create new symlinks. Furthermore, FIFOs can be exploited to cause denial of service conditions by hanging requests indefinitely while waiting for data, impacting availability. The exploitation vector requires an attacker to possess write access to the storage backend as a different operating system user than the one running pgAdmin. This scenario typically arises in environments utilizing shared or network-mounted storage directories where multiple users have permissions, allowing the adversary to create these malicious links and race against the application's file operations to succeed before the check completes.
The operational impact of this vulnerability is severe, encompassing both confidentiality and integrity compromises as well as availability disruptions. An attacker can exfiltrate sensitive data stored within pgAdmin or on the underlying system by reading files outside the designated storage directory through redirected paths. They can also corrupt application state or database contents by overwriting critical configuration files such as servers.json during export/import operations, or by injecting malicious SQL via imported dump files that are processed by backend utilities like pg_restore and psql. The ability to hang requests using FIFOs further degrades system reliability, potentially leading to resource exhaustion if not monitored. These impacts align with CWE-59 Improper Link Resolution Before File Access for the symlink/hard link aspects and CWE-362 Race Condition in TOCTOU scenarios, while the potential for data injection relates closely to CWE-436 Interpretation of External Data.
Mitigation strategies focus on closing the race condition window and enforcing strict file type validation at the point of access rather than just during initial permission checks. The remediation implemented involves opening files by walking down from the storage directory one component at a time, utilizing O_NOFOLLOW flags to prevent any link resolution that would escape the sandboxed environment. This approach ensures that only regular files with exactly one hard link are accepted, effectively neutralizing both symbolic and hard link attacks. Additionally, passing open file descriptors via /dev/fd/N on Linux systems prevents subsequent utility invocations from re-evaluating paths or following links independently of the initial secure check. Administrators should ensure they upgrade to pgAdmin 4 version 9.19 or later where these fixes are applied across all affected code paths including File Manager save operations and data import/export utilities. In environments with shared storage, restricting write access to only the specific operating system user running pgAdmin is a critical compensating control to prevent attackers from creating malicious links in the first place.