Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116243— pgAdmin 4: Utility binary path can point at a shared storage directory

Quick assessment

Affected
pgadmin.org pgAdmin 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pgAdmin 4 会从用户在偏好设置中指定的二进制路径中运行 、 、 和 。在服务器模式下，仅当该二进制路径位于每个用户的存储目录（STORAGE_DIR）下时才会被拒绝；若路径位于普通用户可上传文件的共享存储目录（SHARED_STORAGE）下，则未被拦截。因此，攻击者可以将可执行文件上传至共享存储，将二进制路径指向该文件，从而以运行 pgAdmin 的操作系统账户身份执行该文件。在 POSIX 系统上，通过 pgAdmin 创建的文件默认不可执行，因此该漏洞主要在允许任意具有可执行名称的文件运行的环境中可被

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116243

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pgAdmin 4: Utility binary path can point at a shared storage directory
Source: CVE Program / CVE List V5
Vulnerability Description
pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory (STORAGE_DIR), not under a SHARED_STORAGE directory, which ordinary users can upload files to. A user could therefore upload an executable to shared storage, point their binary path at it, and have pgAdmin run it as the operating-system account running pgAdmin. On POSIX, files created through pgAdmin are not executable, so this is exploitable where any file with an executable name can run, such as Windows server mode. The fix checks the binary path against every SHARED_STORAGE directory as well, after expanding $DIR, collapsing ".." and resolving symbolic links, compares directories in a way a different spelling on a case-insensitive filesystem cannot bypass, refuses a path containing a NUL, and enforces the check wherever binary paths are resolved, including for the PSQL tool. This issue affects pgAdmin 4: before 9.19.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不可信的搜索路径
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pgadmin.org pgAdmin 4 0 ~ 9.19 -

II. Public POCs for CVE-2026-116243

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116243

请登录查看更多情报信息。

Other References for CVE-2026-116243 (2)

Same Patch Batch · pgadmin.org · 2026-10-30 · 15 CVEs total

CVE-2026-116241 9.9 CRITICAL pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-
CVE-2026-116239 8.5 HIGH pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernam
CVE-2026-116249 8.4 HIGH pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
CVE-2026-116247 8.2 HIGH pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certifica
CVE-2026-116245 8.2 HIGH pgAdmin 4: Connection services are not restricted in server mode
CVE-2026-116242 8.2 HIGH pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
CVE-2026-116244 8.2 HIGH pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
CVE-2026-116238 8.1 HIGH pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgA
CVE-2026-116248 6.8 MEDIUM pgAdmin 4: Non-administrators can share a server with every user
CVE-2026-116252 6.5 MEDIUM pgAdmin 4: Materialized view refresh redirects its connection through a crafted database n
CVE-2026-116250 6.5 MEDIUM pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO p
CVE-2026-116246 6.5 MEDIUM pgAdmin 4: Server passwords are left in pgAdmin's process environment
CVE-2026-116240 6.5 MEDIUM pgAdmin 4: File Manager and storage-path tools act on a different path from the one checke
CVE-2026-116251 4.2 MEDIUM pgAdmin 4: A user's other sessions survive a change of their password

IV. Related Vulnerabilities

Same product: pgAdmin 4
Same vendor: pgadmin.org
Same weakness: CWE-426