CVE-2026-116240— pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked

Quick assessment

Affected

pgadmin.org pgAdmin 4

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在服务器模式下，pgAdmin 4 通过函数验证用户存储目录中的路径，该函数利用构建绝对路径。然而，多个调用方以不同的方式构建路径，导致被验证的路径与实际使用的路径可能指向不同的文件：在查询工具中打开文件、读取 Google 客户端密钥，以及在 Windows 系统上进行导入/导出数据、备份、还原和保存文件时，相关操作会在去除路径前导的斜杠和反斜杠后，再将路径拼接至存储目录。在 POSIX 系统上，原本被验证为位于存储目录内的路径，在去除前导字符后可能变为绝对路径，从而允许 pgAdmin 账户读取其可访问的

CVSS 6.5 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 3 AI

T1566 · Phishing T1083 · File and Directory Discovery T1563 · Remote Service Session Hijacking

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked

Source: CVE Program / CVE List V5

Vulnerability Description

In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path with get_abs_path(). Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file in the Query Tool, the Google client secret and, on Windows, Import/Export Data, Backup, Restore and saving a file joined the path to the storage directory after stripping leading slashes and backslashes. On POSIX a path checked as a name inside storage could become an absolute path once stripped, so any file the pgAdmin account can read could be opened; on Windows a path naming a drive discarded the storage directory, so these could read, or write, outside it. - Listing a folder decoded the path a second time after the check, so a folder named like an encoded "..", which a user can create, listed any directory on the host. - Download, delete, rename and the file-exists check appended the path to the storage directory without a separator, so in a deployment where one user's storage directory name is a prefix of another's, another user's files could be read, deleted or moved; download also checked the path appended to itself. - Creating a folder could create one in another user's directory. The fix makes check_access_permission() return the path it checked and every caller act on that path, decodes folder paths once, and opens, deletes and renames files relative to directories opened from the storage directory without following symbolic links. Desktop mode is not affected. This issue affects pgAdmin 4: before 9.19.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pgadmin.org	pgAdmin 4	0 ~ 9.19	-

II. Public POCs for CVE-2026-116240

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116240

请登录查看更多情报信息。

Other References for CVE-2026-116240 (2)

https://www.cve.org/CVERecord?id=CVE-2026-116240

Same Patch Batch · pgadmin.org · 2026-10-30 · 15 CVEs total

CVE-2026-116241	9.9 CRITICAL	pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-
CVE-2026-116239	8.5 HIGH	pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernam
CVE-2026-116249	8.4 HIGH	pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
CVE-2026-116247	8.2 HIGH	pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certifica
CVE-2026-116245	8.2 HIGH	pgAdmin 4: Connection services are not restricted in server mode
CVE-2026-116242	8.2 HIGH	pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
CVE-2026-116244	8.2 HIGH	pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
CVE-2026-116238	8.1 HIGH	pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgA
CVE-2026-116243	7.5 HIGH	pgAdmin 4: Utility binary path can point at a shared storage directory
CVE-2026-116248	6.8 MEDIUM	pgAdmin 4: Non-administrators can share a server with every user
CVE-2026-116252	6.5 MEDIUM	pgAdmin 4: Materialized view refresh redirects its connection through a crafted database n
CVE-2026-116250	6.5 MEDIUM	pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO p
CVE-2026-116246	6.5 MEDIUM	pgAdmin 4: Server passwords are left in pgAdmin's process environment
CVE-2026-116251	4.2 MEDIUM	pgAdmin 4: A user's other sessions survive a change of their password

IV. Related Vulnerabilities

Same product: pgAdmin 4

Same vendor: pgadmin.org

Same weakness: CWE-22