CVE-2026-7819 Details
Description
Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage directory pointing outside it and induce pgAdmin to write to any path reachable by the pgAdmin process. Fix switches the access check to os.path.realpath for both source and destination, and adds an _open_upload_target helper that opens the target with O_NOFOLLOW (mode 0o600) to close the leaf-component TOCTOU between the access check and the open. File mode is hardened from 0o644 to 0o600. This issue affects pgAdmin 4: before 9.15.
A symbolic-link path traversal vulnerability has been identified in pgAdmin 4 File Manager versions prior to 9.15. The issue arises because the `check_access_permission` function uses `os.path.abspath`, which resolves directory traversal sequences but fails to resolve symbolic links. Consequently, an authenticated user could create a symbolic link in their storage directory that points outside of it, leading pgAdmin to write to any path accessible by the pgAdmin process.
This vulnerability has been fixed in pgAdmin 4 version 9.15. Users should upgrade to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pgadmin-org/pgadmin4/issues/9902 | PostgreSQL | Issue TrackingPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-61 | UNIX Symbolic Link (Symlink) Following | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| pgadmin pgadmin 4 | < 9.15 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | PostgreSQL |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | New CVE Received | PostgreSQL |