Executive brief
pgAdmin 4 is a database management tool that lets users write and save SQL queries and entity-relationship diagrams. The File Manager's save_file endpoint checks whether a file path is allowed, but then opens it without protection against symbolic links. An attacker with filesystem access to the pgAdmin server could substitute a symbolic link in the window between the check and the write, causing pgAdmin to create or overwrite arbitrary files on the system as the pgAdmin service account.
Technical details
This is a time-of-check-time-of-use (TOCTOU) vulnerability in pgAdmin 4's File Manager save_file endpoint. The code validates the target path using Filemanager.check_access_permission() to ensure it lies within the user's storage directory, but then calls open() without O_NOFOLLOW protection, which allows the kernel to follow symlinks. If a symbolic link is placed at the final path component between validation and write, the subsequent file operation follows the link and writes outside the containment directory. Exploitation requires filesystem access to the pgAdmin host (direct or via shared/network storage) and successful timing of symlink substitution. A prior CVE-2026-7819 had hardened the file upload path with O_NOFOLLOW but left save_file unprotected. The fix applies O_NOFOLLOW to save_file via an existing helper function, matching upload behavior; it also sets file mode to 0600 and explicitly reports symlink refusal. Note that intermediate directory substitution is not covered by this fix.
Affected products
- pgAdmin pgAdmin 4 before 9.18
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: fix available, routes save_file through O_NOFOLLOW-protected helper