# CVE-2026-7816: PostgreSQL pgAdmin 4 OS command injection in Import/Export query export

Source: https://junglewise.ai/threats/cve-2026-7816-postgresql-pgadmin-4-os-command-injection-in-import-export-query  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-7816 · Severity: high · CVSS 8.8 · Published 2026-05-11

pgAdmin 4 is a popular management tool for PostgreSQL databases. A security vulnerability in its Import/Export feature allows an authorized user to execute unauthorized commands or write files on the server hosting the application. This could lead to a full system compromise, data theft, or disruption of operations.

Technologies: [PostgreSQL pgAdmin 4](https://junglewise.ai/threats/technologies/pgadmin-4), [pgadmin4 (PyPI)](https://junglewise.ai/threats/technologies/pgadmin4). Vendors: [PostgreSQL](https://junglewise.ai/threats/vendors/postgresql), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-7816 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7816 being exploited in the wild.

**How severe is CVE-2026-7816?** High severity, with a CVSS score of 8.8, published 11 May 2026.

**Which products and versions are affected?** PostgreSQL pgAdmin 4 >= 9.4, < 9.15, 9.4 to < 9.15; pgadmin4 (PyPI) < 9.15, ECOSYSTEM:introduced=0,fixed=9.15.

**Is there a fix for CVE-2026-7816?** Yes. pgadmin4 (PyPI): upgrade to 9.15 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-7816 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-7816?** Check whether you run PostgreSQL pgAdmin 4 or pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pgadmin4 (PyPI): upgrade to 9.15 or later

  ```sh
  pip install "pgadmin4>=9.15"
  ```


## Technical details

An OS command injection (CWE-78) exists in pgAdmin 4 due to improper sanitization of user-supplied input before it is interpolated into a psql \copy metacommand template. An authenticated attacker can provide a crafted query containing ") TO PROGRAM 'cmd'" to break out of the command context and execute arbitrary shell commands or write to local files. Other fields including format, on_error, and log_verbosity were also found to be vulnerable to raw interpolation. The vulnerability is fixed in version 9.15 by implementing a parenthesis-balancing parser, allow-listing specific fields, and rejecting null bytes.

## Affected products

- PostgreSQL pgAdmin 4 9.4 to < 9.15

## Identifiers

- CVE-2026-7816
- GHSA-j74f-g7vx-fh4x
- PYSEC-2026-2870

## Timeline

- 2026-05-01: disclosed: Issue reported on GitHub
- 2026-05-11: advisory: CVE published and NVD entry created
- 2026-05-11: patched: Fixed in version 9.15

## References

- [https://github.com/pgadmin-org/pgadmin4/issues/9899](https://github.com/pgadmin-org/pgadmin4/issues/9899)

## Related threats

- [PostgreSQL pgAdmin 4 missing authorization in per-tool permissions](https://junglewise.ai/threats/cve-2026-17350-postgresql-pgadmin-4-missing-authorization-in-per-tool)
- [PostgreSQL pgAdmin 4 credential leak in Workspaces adhoc connection](https://junglewise.ai/threats/cve-2026-17349-postgresql-pgadmin-4-credential-leak-in-workspaces-adhoc)
- [PYSEC-2026-2864 - pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability](https://junglewise.ai/threats/cve-2026-1707-pgadmin-4-restore-restriction-bypass-via-key-disclosure)
- [PYSEC-2026-1769 - pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability](https://junglewise.ai/threats/cve-2025-9636-pgadmin4-is-affected-by-a-cross-origin-opener-policy-coop)
- [PYSEC-2026-1770 - pgAdmin has Incorrect Default Permissions](https://junglewise.ai/threats/cve-2023-1907-pgadmin-has-incorrect-default-permissions)