PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7819 pgadmin.org CVE debrief

A symbolic-link path traversal vulnerability in pgAdmin 4's File Manager allows authenticated users to write files to arbitrary locations on the server filesystem. The root cause is a mismatch between access validation and file operations: `check_access_permission` uses `os.path.abspath`, which normalizes parent-directory references but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An attacker can plant a symbolic link within their own storage directory pointing outside it, then induce pgAdmin to write to any path reachable by the pgAdmin process. The fix replaces `os.path.abspath` with `os.path.realpath` for both source and destination paths, introduces an `_open_upload_target` helper that opens targets with `O_NOFOLLOW` (mode 0o600) to eliminate the leaf-component TOCTOU window between access check and open, and hardens file permissions from 0o644 to 0o600. Affected versions are pgAdmin 4 before 9.15.

Vendor
pgadmin.org
Product
pgAdmin 4
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-11
Original CVE updated
2026-05-26
Advisory published
2026-05-11
Advisory updated
2026-05-26

Who should care

Organizations running pgAdmin 4 versions prior to 9.15 with File Manager functionality enabled, particularly those with multi-user deployments where storage isolation between users is security-critical. Database administrators and security teams responsible for pgAdmin infrastructure should prioritize patching.

Technical summary

The pgAdmin 4 File Manager's `check_access_permission` function relied on `os.path.abspath` for path normalization, which does not resolve symbolic links. This created a race condition where an authenticated attacker could place a symlink in their storage directory pointing to sensitive system locations, and the subsequent file write operation would follow the symlink. The fix implements `os.path.realpath` for canonical path resolution and adds `O_NOFOLLOW` protection during file open operations to prevent symlink following, alongside hardened file permissions (0o600 vs 0o644).

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade pgAdmin 4 to version 9.15 or later to obtain the symbolic link traversal fix
  • If immediate patching is not possible, restrict pgAdmin 4 File Manager access to trusted administrative users only
  • Review filesystem permissions to ensure the pgAdmin process runs with minimal necessary privileges
  • Monitor for unexpected file writes in directories outside configured user storage paths
  • Audit existing user storage directories for unexpected symbolic links prior to upgrade

Evidence notes

The vulnerability description and fix details are derived from the official CVE record and NVD entry. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N) indicates network attack vector with low attack complexity, low privileges required, and high impact to integrity and availability. CWE-61 (UNIX Symbolic Link Following) and CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) are identified as applicable weaknesses.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-7819 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-7819

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-7819 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-7819

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://github.com/pgadmin-org/pgadmin4/issues/9902

    f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 - Issue Tracking, Patch, Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.