Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-120066— psqlODBC log files are created with default permissions at a predictable path and follow symbolic links

Quick assessment

Affected

PostgreSQL psqlODBC

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在类 Unix 系统上，当启用日志功能时，psqlODBC 默认会在目录下创建日志文件。这些文件的命名由程序名、用户名和进程 ID 组成，默认权限通常为所有用户可读，并且在打开文件时会跟随符号链接。因此，本地用户可以读取其他用户的查询文本和数据；此外，攻击者还可在可预测的路径下放置符号链接，诱使驱动程序以受害者的权限将日志数据追加到攻击者指定的文件中。受影响的版本为 psqlODBC 18.00.0006 之前的所有版本。

CVSS 5.3 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1040 · Network Sniffing T1565.001 · Stored Data Manipulation

Affected Version Matrix 1

Vendor	Product	Version Range	Status
PostgreSQL	psqlODBC	`< 18.00.0006`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

psqlODBC log files are created with default permissions at a predictable path and follow symbolic links

Source: CVE Program / CVE List V5

Vulnerability Description

On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

关键资源的不正确权限授予

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
PostgreSQL	psqlODBC	0 ~ 18.00.0006	-

II. Public POCs for CVE-2026-120066

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120066

请登录查看更多情报信息。

Other References for CVE-2026-120066 (1)

https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-wj7r-6pj3-62g8 vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120066

Same Patch Batch · PostgreSQL · 2026-11-02 · 11 CVEs total

CVE-2026-120062	7.5 HIGH	psqlODBC SQL injection through SQLSpecialColumns table and schema names
CVE-2026-120061	7.5 HIGH	psqlODBC ODBC escape parser stack buffer overflow
CVE-2026-120058	7.5 HIGH	psqlODBC row cache overflow when a later FETCH changes the column count
CVE-2026-120057	7.5 HIGH	psqlODBC large-object read overflows the application buffer
CVE-2026-120064	7.5 HIGH	psqlODBC does not validate column numbers and row indexes in binding and descriptor functi
CVE-2026-120065	7.1 HIGH	psqlODBC does not escape a server-supplied column name in its updatable-cursor queries
CVE-2026-120059	6.8 MEDIUM	psqlODBC uses a server-supplied column name as a format string
CVE-2026-120060	5.9 MEDIUM	psqlODBC does not validate server-supplied counts and lengths
CVE-2026-120067	5.9 MEDIUM	psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors
CVE-2026-120063	5.9 MEDIUM	psqlODBC stack buffer overflow when quoting long schema and table names

IV. Related Vulnerabilities

Same product: psqlODBC

Same vendor: PostgreSQL

Same weakness: CWE-732