PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7819 pgadmin.org CVE debrief

A symbolic-link path traversal vulnerability in pgAdmin 4's File Manager allows authenticated users to write files to arbitrary locations on the server filesystem. The root cause is a mismatch between access validation and file operations: `check_access_permission` uses `os.path.abspath`, which normalizes parent-directory references but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An attacker can plant a symbolic link within their own storage directory pointing outside it, then induce pgAdmin to write to any path reachable by the pgAdmin process. The fix replaces `os.path.abspath` with `os.path.realpath` for both source and destination paths, introduces an `_open_upload_target` helper that opens targets with `O_NOFOLLOW` (mode 0o600) to eliminate the leaf-component TOCTOU window between access check and open, and hardens file permissions from 0o644 to 0o600. Affected versions are pgAdmin 4 before 9.15.

Vendor
pgadmin.org
Product
pgAdmin 4
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-11
Original CVE updated
2026-05-26
Advisory published
2026-05-11
Advisory updated
2026-05-26

Who should care

Organizations running pgAdmin 4 versions prior to 9.15 with File Manager functionality enabled, particularly those with multi-user deployments where storage isolation between users is security-critical. Database administrators and security teams responsible for pgAdmin infrastructure should prioritize patching.

Technical summary

The pgAdmin 4 File Manager's `check_access_permission` function relied on `os.path.abspath` for path normalization, which does not resolve symbolic links. This created a race condition where an authenticated attacker could place a symlink in their storage directory pointing to sensitive system locations, and the subsequent file write operation would follow the symlink. The fix implements `os.path.realpath` for canonical path resolution and adds `O_NOFOLLOW` protection during file open operations to prevent symlink following, alongside hardened file permissions (0o600 vs 0o644).

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade pgAdmin 4 to version 9.15 or later to obtain the symbolic link traversal fix
  • If immediate patching is not possible, restrict pgAdmin 4 File Manager access to trusted administrative users only
  • Review filesystem permissions to ensure the pgAdmin process runs with minimal necessary privileges
  • Monitor for unexpected file writes in directories outside configured user storage paths
  • Audit existing user storage directories for unexpected symbolic links prior to upgrade

Evidence notes

The vulnerability description and fix details are derived from the official CVE record and NVD entry. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N) indicates network attack vector with low attack complexity, low privileges required, and high impact to integrity and availability. CWE-61 (UNIX Symbolic Link Following) and CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) are identified as applicable weaknesses.

Official resources

CVE-2026-7819 was published on 2026-05-11 and last modified on 2026-05-26. No KEV listing or known ransomware campaign use has been reported.