Executive brief
pgAdmin 4 is a popular management tool for PostgreSQL databases. A vulnerability in its File Manager component allows an authenticated user to bypass security restrictions and write files to unauthorized locations on the server. This could lead to data corruption, service disruption, or unauthorized system modifications by overwriting critical configuration files.
Technical details
A symbolic link (symlink) path traversal vulnerability (CWE-61, CWE-22) exists in the pgAdmin 4 File Manager. The 'check_access_permission' function utilized 'os.path.abspath', which resolves parent directory references ('..') but fails to resolve symbolic links. Because subsequent kernel-level write operations follow symlinks, an authenticated attacker can create a symlink within their assigned storage directory that points to a location outside of it. By inducing the application to write to this symlink, the attacker can overwrite any file the pgAdmin process has permissions to access. The fix involves migrating to 'os.path.realpath' for path validation and implementing 'O_NOFOLLOW' during file creation to prevent Time-of-Check to Time-of-Use (TOCTOU) exploits.
Affected products
- PostgreSQL pgAdmin 4 < 9.15
Timeline
- 2026-05-01: other: Issue opened on GitHub
- 2026-05-11: advisory: NVD and GitHub Advisory published
- 2026-05-11: patched: Fixed in version 9.15