Executive brief
pgAdmin 4, a popular management tool for PostgreSQL databases, contains a security flaw in how it handles user session files. An attacker with local access to the system could place a malicious file in the session directory to take full control of the application. This could allow them to execute unauthorized commands on the underlying server with the same permissions as the pgAdmin service.
Technical details
A deserialization of untrusted data vulnerability (CWE-502) exists in the pgAdmin 4 FileBackedSessionManager. The component used Python's standard object-serialization module (pickle) to process session-file contents without first verifying their integrity via HMAC. An authenticated local attacker with write access to the sessions directory—potentially gained through misconfiguration or a separate path-traversal vulnerability—can plant a crafted serialized payload. Upon processing the file, the application executes the payload, leading to remote code execution (RCE) under the pgAdmin process identity. The issue is resolved in version 9.15 by implementing a SHA-256 HMAC check before deserialization and hardening file permissions.
Affected products
- PostgreSQL pgAdmin 4 before 9.15
Timeline
- 2026-05-01: disclosed: Issue reported on GitHub
- 2026-05-11: advisory: CVE published
- 2026-05-11: patched: Fixed in version 9.15