CVE-2026-86861 pgadmin.org CVE debrief

Who should care

Defenders responsible for pgAdmin 4 deployments should assess exposure and prioritize patching to prevent potential arbitrary file creation or overwrite. This includes reviewing file system permissions and access controls, monitoring for suspicious file system activity, and verifying pgAdmin 4 versions. Security teams should focus on validating affected scope, severity, and vendor guidance to ensure proper mitigation.

Why it matters

CVE-2026-86861 is a vulnerability in pgAdmin 4's File Manager save_file endpoint that allows an attacker to create or overwrite an arbitrary file as the operating-system account running pgAdmin. Defenders should prioritize verifying pgAdmin 4 versions and applying patches to prevent potential arbitrary file creation or overwrite.

• Verify pgAdmin 4 versions and apply patches to prevent potential arbitrary file creation or overwrite
• Review file system permissions and access controls to prevent exploitation
• Monitor for suspicious file system activity to detect potential attacks

Technical summary

The pgAdmin 4 File Manager save_file endpoint did not protect against a symbolic link attack, allowing an attacker to create or overwrite an arbitrary file as the operating-system account running pgAdmin. This issue arises from the endpoint validating the requested path with Filemanager.check_access_permission() but then opening the file for writing with a plain open() call. The fix introduces protection by routing save_file's write through an O_NOFOLLOW-protected helper, similar to the upload path. This change also reports a symbolic-link refusal explicitly and sets created files to mode 0600.

Defensive priority

Defenders should prioritize verifying pgAdmin 4 versions and applying patches to prevent potential arbitrary file creation or overwrite.

Recommended defensive actions

• Verify pgAdmin 4 versions and apply patches
• Review file system permissions and access controls
• Monitor for suspicious file system activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability was reported through a GitHub issue and affects pgAdmin 4. The fix routes save_file's write through an O_NOFOLLOW-protected helper. Evidence is limited to public statements from the vendor and issue tracker. Defenders should verify pgAdmin 4 versions, review file system permissions, and monitor for suspicious activity to detect potential attacks. The reporter did not achieve a write against a released version, having attempted approximately 63,000 racing requests without success.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.