pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
Impact
pgAdmin 4, before version 9.19, is affected by a path traversal vulnerability, allowing an attacker with access to the server dialog, REST API, or servers.json import to potentially access another user's files. The issue arises from improper path resolution and quoting of connection parameter values.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.The fix requires the resolved path, with symbolic links followed, to stay inside the user's storage directory or the named shared storage directory, confines sslkeylogfile the same way, and accepts only exact libpq keywords as connection parameter names.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
pgadmin.org · PostgreSQL
pgAdmin 4
1 range
pgadmin.org · PostgreSQL
pgAdmin 4
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 9.19
custom versions
Other versions: unaffected
Original source description
In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but get_complete_file_path() only stripped leading slashes before joining the two. A path such as "../<another user>/.pgpass", set through the server dialog, the REST API or a servers.json import, therefore named another user's file, and connecting used that user's saved passwords, client certificate or SSH key. The sslkeylogfile connection parameter was passed to libpq unchanged, so a path outside storage let libpq create or append a file as the account running pgAdmin.
make_conninfo() also quoted connection parameter values but not their names, so a crafted parameter name could smuggle additional keyword=value pairs past these checks.
The fix requires the resolved path, with symbolic links followed, to stay inside the user's storage directory or the named shared storage directory, confines sslkeylogfile the same way, and accepts only exact libpq keywords as connection parameter names. A refused path or keyword is reported instead of letting libpq fall back to a default.
This issue affects pgAdmin 4: before 9.19.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-116249View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.