# CVE-2026-116243: pgAdmin 4 arbitrary code execution via binary path validation bypass

Source: https://junglewise.ai/threats/cve-2026-116243-pgadmin-4-runs-pg-dump-pg-restore-pg-dumpall-and-psql-from-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-116243 · Severity: high · CVSS 7.5 · Published 2026-10-30

pgAdmin 4 is a web-based administration tool for PostgreSQL databases. An authenticated user can upload a malicious executable to shared storage, configure pgAdmin to run it as a PostgreSQL utility (pg_dump, pg_restore, psql, or pg_dumpall), and execute arbitrary code with the privileges of the pgAdmin server process. This allows complete compromise of the database server and underlying system.

Technologies: [Pgadmin 4](https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4). Vendors: [pgAdmin](https://junglewise.ai/threats/vendors/pgadmin).

## Quick answers

**Is CVE-2026-116243 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116243 being exploited in the wild.

**How severe is CVE-2026-116243?** High severity, with a CVSS score of 7.5, published 30 October 2026.

**Which products and versions are affected?** Pgadmin 4 before 9.19.

**Is there a fix for CVE-2026-116243?** Yes: fixed in pgAdmin 4 9.19. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116243 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116243?** Check whether you run Pgadmin 4 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in pgAdmin 4 9.19

## Technical details

pgAdmin 4 validates binary paths only against the per-user STORAGE_DIR but not against SHARED_STORAGE directories, allowing authenticated users to upload executable files to shared storage and redirect pgAdmin to execute them via pg_dump, pg_restore, pg_dumpall, or psql. The vulnerability is exploitable on Windows server mode and systems where arbitrary filenames are executable. The fix adds comprehensive path validation including symlink resolution, ".." collapsing, case-insensitive comparison, and NUL character rejection.

## Affected products

- pgAdmin pgAdmin 4 before 9.19

## Timeline

- 2026-10-30: advisory

## References

- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/__init__.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/__init__.py)
- [https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/__init__.py](https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/__init__.py)

## Related threats

- [pgAdmin 4 session invalidation failure after password change](https://junglewise.ai/threats/cve-2026-116251-pgadmin-4-did-not-invalidate-a-user-s-existing-sessions-when)
- [pgAdmin 4 path traversal in server credentials](https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl)
- [pgAdmin 4 unauthorized server sharing to all users](https://junglewise.ai/threats/cve-2026-116248-in-pgadmin-4-server-mode-only-administrators-are-meant-to-share)
- [pgAdmin credential injection via libpq service file](https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the)
- [pgAdmin 4 Kerberos credential exposure authentication bypass](https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user)