Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-17566— pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

Quick assessment

Affected
pgadmin.org pgAdmin 4
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pgAdmin是pgAdmin组织开源的一个用于开源数据库 PostgreSQL 的开源管理和开发平台。 pgAdmin 9.18之前版本存在安全漏洞，该漏洞源于括号平衡检查器对反斜杠转义处理不当，可能导致攻击者通过特制SQL查询注入psql命令并执行任意命令。

CVSS 9.9 · Critical EPSS 0.67% · P50

Affected Version Matrix 1

VendorProduct Version RangeStatus
pgadmin.org pgAdmin 4 < 9.18 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-17566

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)
Source: CVE Program / CVE List V5
Vulnerability Description
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrapper, create_import_export_job() (route POST /import_export/job/<sid>, gated only by the ordinary, commonly-granted tools_import_export_data permission) validated the query with a hand-written parenthesis-balance checker, _is_query_parens_balanced(). That checker always treated a backslash before a single quote (\') as escaping the quote, i.e. as if standard_conforming_strings were off. PostgreSQL has defaulted standard_conforming_strings to on since 9.1 (2010), the default on every PostgreSQL version pgAdmin 4 currently supports (13-18); under that default psql's own \copy tokenizer treats \ as an ordinary character, so a single quote immediately after it closes the string literal. A query such as SELECT 'a\') TO PROGRAM 'echo pwned' x' was therefore accepted as "balanced" by pgAdmin's checker (which believed the ) was still inside the string), while psql, run through the actual rendered command line, closes the string at that point and treats the following ) as the end of the wrapping \copy (...) subquery, exposing an attacker-chosen TO PROGRAM '<command>' clause that psql executes via popen() -- independent of a subsequent syntax error later on the same line. This is the same class of bug as CVE-2025-12762/CVE-2025-13780 (RCE via psql meta-command/COPY injection during PLAIN-format dump restore), reached through an independently written defense in a different module (Import/Export Data rather than Restore) that had its own, different logic bug (inverted backslash-escape semantics rather than a BOM-defeated regex anchor). The fix rejects any backslash inside a single-quoted string in the query outright, rather than picking one of the two possible psql interpretations. This is intentionally conservative: because the correct interpretation of \ depends on the target server's standard_conforming_strings setting, which the checker cannot reliably know at validation time, refusing the query is safer than guessing. This issue affects pgAdmin 4: from the introduction of _is_query_parens_balanced() before 9.18.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
pgAdmin 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
pgAdmin是pgAdmin组织开源的一个用于开源数据库 PostgreSQL 的开源管理和开发平台。 pgAdmin 9.18之前版本存在安全漏洞，该漏洞源于括号平衡检查器对反斜杠转义处理不当，可能导致攻击者通过特制SQL查询注入psql命令并执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
pgadmin.org pgAdmin 4 0 ~ 9.18 -

II. Public POCs for CVE-2026-17566

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 8316 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-17566

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-17566 (1)

Other References for CVE-2026-17566 (1)

Same Patch Batch · pgadmin.org · 2026-07-31 · 7 CVEs total

CVE-2026-17349 9.6 CRITICAL pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownersh
CVE-2026-17351 9.0 CRITICAL pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagre
CVE-2026-17346 8.8 HIGH pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/su
CVE-2026-17347 7.5 HIGH pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitutio
CVE-2026-17348 6.5 MEDIUM pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Sche
CVE-2026-17350 5.4 MEDIUM pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

IV. Related Vulnerabilities

Same product: pgAdmin 4
Same vendor: pgadmin.org
Same weakness: CWE-78

V. Comments for CVE-2026-17566

No comments yet

Leave a comment