CVE-2026-111439 Details
Description
在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks() 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall()。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 is_row_data_file() 也仅用于识别文件形态，未包含权限检查。因此，任何拥有普通数据库连接权限的用户，只要能够通过 pg_relation_filepath() 等函数获取到目标表的底层关系文件路径（例如压缩数据的 _compress 文件路径），即可无需具备该表的 SELECT 权限，直接读取表数据的二进制块。 此漏洞影响此前3.0.0到6.0.0间的所有版本及补丁版，并在7.0.0-LTS版本修复。修复patch详见：https://gitcode.com/opengauss/openGauss-server/pull/9374。
A vulnerability exists in the openGauss Server in the genfile.cpp module, where the built-in function pg_read_binary_file_blocks() has a flaw in its permission validation logic. The function only checks the range of the starting block number and block count before directly calling the underlying file reading routine, ReadBinaryFileBlocksFirstCall(). This routine performs basic path normalization and checks for path traversal and data directory boundaries but fails to verify the caller's database permissions, such as SELECT rights. Additionally, the helper function is_row_data_file() only identifies file types without including permission checks. As a result, any user with a standard database connection can, without the necessary SELECT permission, read binary blocks of table data from the underlying relation file, provided they can obtain the file path through functions like pg_relation_filepath(). This vulnerability affects all versions from 3.0.0 prior to 6.0.0 and has been patched in version 7.0.0-LTS.
Users can upgrade to openGauss Server version 7.0.0-LTS, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitcode.com/opengauss/openGauss-server/pull/9374 | openGauss Community | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | openGauss Community |
Affected Products
| Product | Versions |
|---|---|
| openGauss-server | >= 3.0.0, <= 6.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | openGauss Community |