Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116241— pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier

Quick assessment

Affected
pgadmin.org pgAdmin 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pgAdmin 4 的“导入/导出数据”工具会将用户查询的导出操作包装在 命令中，并检查查询中的括号是否成对，以防止内容从包装结构中逃逸。该检查会拒绝单引号字符串内出现的反斜杠，但未拒绝双引号标识符内的反斜杠；在这种情况下，工具将随后的双引号视为标识符的结束符。然而， 的 解析器会根据开启该记号的引号类型，应用连接所配置的转义字符。因此，当 设置为 时，经过反斜杠转义的双引号并不会结束标识符。这导致 pgAdmin 与 psql 对引号的理解出现分歧：一个被检查机制忽略的闭合括号提前结束了 包装结构，而随后的 子句

CVSS 9.9 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116241

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier
Source: CVE Program / CVE List V5
Vulnerability Description
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, where it treated the next double quote as closing the identifier. psql's \copy parser applies the connection's escape character to whichever quote opened a token, so with standard_conforming_strings off a backslash-escaped double quote does not close the identifier. pgAdmin's and psql's view of the quoting then diverged, a closing parenthesis hidden from the check ended the \copy (...) wrapper, and a following TO PROGRAM clause was executed by psql on the pgAdmin host, as the operating-system account running pgAdmin, before the server rejected the statement. An ordinary database role can turn standard_conforming_strings off for itself, and the Import/Export Data permission is granted to non-administrators by default. This is a bypass of the fix for CVE-2026-17566. The fix rejects any backslash inside a double-quoted identifier, as was already done for single-quoted strings, since its meaning depends on a server setting that cannot be known reliably when the query is validated. This issue affects pgAdmin 4: before 9.19.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pgadmin.org pgAdmin 4 0 ~ 9.19 -

II. Public POCs for CVE-2026-116241

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116241

请登录查看更多情报信息。

Other References for CVE-2026-116241 (2)

Same Patch Batch · pgadmin.org · 2026-10-30 · 15 CVEs total

CVE-2026-116239 8.5 HIGH pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernam
CVE-2026-116249 8.4 HIGH pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
CVE-2026-116247 8.2 HIGH pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certifica
CVE-2026-116245 8.2 HIGH pgAdmin 4: Connection services are not restricted in server mode
CVE-2026-116242 8.2 HIGH pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
CVE-2026-116244 8.2 HIGH pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
CVE-2026-116238 8.1 HIGH pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgA
CVE-2026-116243 7.5 HIGH pgAdmin 4: Utility binary path can point at a shared storage directory
CVE-2026-116248 6.8 MEDIUM pgAdmin 4: Non-administrators can share a server with every user
CVE-2026-116252 6.5 MEDIUM pgAdmin 4: Materialized view refresh redirects its connection through a crafted database n
CVE-2026-116250 6.5 MEDIUM pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO p
CVE-2026-116246 6.5 MEDIUM pgAdmin 4: Server passwords are left in pgAdmin's process environment
CVE-2026-116240 6.5 MEDIUM pgAdmin 4: File Manager and storage-path tools act on a different path from the one checke
CVE-2026-116251 4.2 MEDIUM pgAdmin 4: A user's other sessions survive a change of their password

IV. Related Vulnerabilities

Same product: pgAdmin 4
Same vendor: pgadmin.org
Same weakness: CWE-78