CVE-2026-7816

OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a psql \copy metacommand template without sanitization. An authenticated user could inject ") TO PROGRAM 'cmd'" to break out of the \copy (...) context and achieve arbitrary command execution on the pgAdmin server, or ") TO '/path'" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable. Fix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks. This issue affects pgAdmin 4: before 9.15.

• CWE-78

• https://github.com/pgadmin-org/pgadmin4/issues/9899Issue Tracking, Patch, Vendor Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78154Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-78155privilege escalation in StackGres operator allows a low-priv…9.9
• CVE-2026-78156A security vulnerability has been detected in Open5GS 2.8.0.…7.4
• CVE-2026-78157A vulnerability was detected in Open5GS 2.8.0. This affects …7.4
• CVE-2026-78158A flaw has been found in Open5GS 2.8.0. This vulnerability a…6.3
• CVE-2026-78159The The Events Calendar plugin for WordPress is vulnerable t…9.8
• CVE-2026-78160A vulnerability has been found in Dolibarr ERP up to 18.0.10…6.3
• CVE-2026-78161A vulnerability was found in warmcat libwebsockets 4.5.0. Im…7.3
• CVE-2026-78166A security flaw has been discovered in provectus kafka-ui up…6.3
• CVE-2026-78167A weakness has been identified in EFM ipTIME T16000M 14.20.2…10
• CVE-2026-78168A security vulnerability has been detected in EFM ipTIME T24…9.8
• CVE-2026-78169A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7…9.9