# CVE-2026-86861: pgAdmin 4 File Manager TOCTOU symlink write bypass in save_file

Source: https://junglewise.ai/threats/cve-2026-86861-pgadmin-4-file-manager-toctou-symlink-write-bypass-in-save-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86861 · Severity: medium · CVSS 5.9 · Published 2026-09-17

pgAdmin 4 is a database management tool that lets users write and save SQL queries and entity-relationship diagrams. The File Manager's save_file endpoint checks whether a file path is allowed, but then opens it without protection against symbolic links. An attacker with filesystem access to the pgAdmin server could substitute a symbolic link in the window between the check and the write, causing pgAdmin to create or overwrite arbitrary files on the system as the pgAdmin service account.

## Quick answers

**Is CVE-2026-86861 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86861 being exploited in the wild.

**How severe is CVE-2026-86861?** Medium severity, with a CVSS score of 5.9, published 17 September 2026.

**Which products and versions are affected?** pgAdmin pgAdmin 4 before 9.18.

**Is there a fix for CVE-2026-86861?** A patch was published on 2026-09-17: fix available, routes save_file through O_NOFOLLOW-protected helper Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86861 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-86861?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a time-of-check-time-of-use (TOCTOU) vulnerability in pgAdmin 4's File Manager save_file endpoint. The code validates the target path using Filemanager.check_access_permission() to ensure it lies within the user's storage directory, but then calls open() without O_NOFOLLOW protection, which allows the kernel to follow symlinks. If a symbolic link is placed at the final path component between validation and write, the subsequent file operation follows the link and writes outside the containment directory. Exploitation requires filesystem access to the pgAdmin host (direct or via shared/network storage) and successful timing of symlink substitution. A prior CVE-2026-7819 had hardened the file upload path with O_NOFOLLOW but left save_file unprotected. The fix applies O_NOFOLLOW to save_file via an existing helper function, matching upload behavior; it also sets file mode to 0600 and explicitly reports symlink refusal. Note that intermediate directory substitution is not covered by this fix.

## Affected products

- pgAdmin pgAdmin 4 before 9.18

## Timeline

- 2026-09-17: disclosed
- 2026-09-17: patched: fix available, routes save_file through O_NOFOLLOW-protected helper