CVE-2026-116250

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it with a plain open() or handed the path to a utility that opened it later: the servers.json export and import and the import file listing, and the files given to pg_dump, pg_dumpall, pg_restore and psql by Backup, Restore and Import/Export Data. A symbolic link swapped in at the file or at any parent directory between the check and the open redirected the operation outside the storage directory, so a file could be written, overwritten or read, or loaded into a table, as the operating-system account running pgAdmin. A hard link to an outside file, which O_NOFOLLOW does not detect, and a FIFO, which could hang a request, had the same effect. CVE-2026-86861 fixed this for the File Manager's save_file; these were the remaining paths. Exploitation requires creating such a link or FIFO inside the user's storage directory. pgAdmin offers no way to do so, and the per-user storage directories belong to the pgAdmin account, so this requires write access to the storage backend as a different operating-system user, for example a shared or network-mounted storage directory, and winning the race. The fix opens each file by walking down from the storage directory one component at a time with O_NOFOLLOW, accepting only a regular file with one link, and passes the utilities the open descriptor (/dev/fd/N) on Linux. Error messages no longer include the server path. This issue affects pgAdmin 4: before 9.19.

• CWE-59
• CWE-367

• https://github.com/pgadmin-org/pgadmin4/commit/730d1e783c339ec696a1f77f2eee6f4b52cb6c37
• https://github.com/pgadmin-org/pgadmin4/commit/99f5606e2ebc7c94c7acdbab877ce7de54bfc756
• https://github.com/pgadmin-org/pgadmin4/commit/c4321b9968342716f34bc5f10de6cac3c0567e68
• https://github.com/pgadmin-org/pgadmin4/issues/10647

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116245libpq looks a connection service up in the service file of t…8.2
• CVE-2026-116246To pass a server's password to psql and to the utilities pgA…6.5
• CVE-2026-116247When a server in pgAdmin 4 had no password file, client cert…8.2
• CVE-2026-116248In pgAdmin 4 server mode only administrators are meant to sh…6.8
• CVE-2026-116249In server mode pgAdmin 4 resolves a server's password file, …8.4
• CVE-2026-11625Bytes::Random::Secure versions through 0.29 for Perl share i…7.5
• CVE-2026-116251pgAdmin 4 did not invalidate a user's existing sessions when…4.2
• CVE-2026-116252pgAdmin 4's materialized view refresh passed the target data…6.5
• CVE-2026-116253A vulnerability was determined in DedeCMS 5.7.118. This vuln…7.3
• CVE-2026-116254A vulnerability was identified in rathena FluxCP up to 98cd4…6.5
• CVE-2026-116255A vulnerability has been found in PGYER codefever up to 0c35…5.3
• CVE-2026-116256A vulnerability was found in geesondog RhaPHP up to 7ae639cc…7.3