Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116250— pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check

Quick assessment

Affected
pgadmin.org pgAdmin 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在服务器模式下，pgAdmin 4 会先通过 函数验证用户提供的存储目录中的文件路径，随后再按名称打开该文件。然而，在多个位置，系统直接使用普通的 打开文件，或将路径传递给后续由工具（如 、 、 和 ）打开的文件。这些位置包括： 的导出与导入、导入文件列表，以及备份、恢复和数据导入/导出功能所指定的文件。 若在路径检查与文件打开之间，攻击者在目标文件或任意父目录中植入符号链接（symbolic link），即可将操作重定向至存储目录之外。这使得攻击者能够以运行 pgAdmin 的操作系统账户身份，对目录外的文件进行

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116250

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check
Source: CVE Program / CVE List V5
Vulnerability Description
In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it with a plain open() or handed the path to a utility that opened it later: the servers.json export and import and the import file listing, and the files given to pg_dump, pg_dumpall, pg_restore and psql by Backup, Restore and Import/Export Data. A symbolic link swapped in at the file or at any parent directory between the check and the open redirected the operation outside the storage directory, so a file could be written, overwritten or read, or loaded into a table, as the operating-system account running pgAdmin. A hard link to an outside file, which O_NOFOLLOW does not detect, and a FIFO, which could hang a request, had the same effect. CVE-2026-86861 fixed this for the File Manager's save_file; these were the remaining paths. Exploitation requires creating such a link or FIFO inside the user's storage directory. pgAdmin offers no way to do so, and the per-user storage directories belong to the pgAdmin account, so this requires write access to the storage backend as a different operating-system user, for example a shared or network-mounted storage directory, and winning the race. The fix opens each file by walking down from the storage directory one component at a time with O_NOFOLLOW, accepting only a regular file with one link, and passes the utilities the open descriptor (/dev/fd/N) on Linux. Error messages no longer include the server path. This issue affects pgAdmin 4: before 9.19.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
检查时间与使用时间(TOCTOU)的竞争条件
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pgadmin.org pgAdmin 4 0 ~ 9.19 -

II. Public POCs for CVE-2026-116250

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116250

请登录查看更多情报信息。

Other References for CVE-2026-116250 (4)

Same Patch Batch · pgadmin.org · 2026-10-30 · 15 CVEs total

CVE-2026-116241 9.9 CRITICAL pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-
CVE-2026-116239 8.5 HIGH pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernam
CVE-2026-116249 8.4 HIGH pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
CVE-2026-116247 8.2 HIGH pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certifica
CVE-2026-116245 8.2 HIGH pgAdmin 4: Connection services are not restricted in server mode
CVE-2026-116242 8.2 HIGH pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
CVE-2026-116244 8.2 HIGH pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
CVE-2026-116238 8.1 HIGH pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgA
CVE-2026-116243 7.5 HIGH pgAdmin 4: Utility binary path can point at a shared storage directory
CVE-2026-116248 6.8 MEDIUM pgAdmin 4: Non-administrators can share a server with every user
CVE-2026-116252 6.5 MEDIUM pgAdmin 4: Materialized view refresh redirects its connection through a crafted database n
CVE-2026-116246 6.5 MEDIUM pgAdmin 4: Server passwords are left in pgAdmin's process environment
CVE-2026-116240 6.5 MEDIUM pgAdmin 4: File Manager and storage-path tools act on a different path from the one checke
CVE-2026-116251 4.2 MEDIUM pgAdmin 4: A user's other sessions survive a change of their password

IV. Related Vulnerabilities

Same product: pgAdmin 4
Same vendor: pgadmin.org
Same weakness: CWE-367