{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-116240","assignerOrgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","state":"PUBLISHED","assignerShortName":"PostgreSQL","dateReserved":"2026-10-25T16:26:16.419Z","datePublished":"2026-10-30T19:55:12.603Z","dateUpdated":"2026-10-30T19:55:12.603Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","shortName":"PostgreSQL","dateUpdated":"2026-10-30T19:55:12.603Z"},"title":"pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked","datePublic":"2026-10-29T00:00:00.000Z","affected":[{"vendor":"pgadmin.org","product":"pgAdmin 4","repo":"https://github.com/pgadmin-org/pgadmin4","modules":["File Manager","Import/Export Data","Backup","Restore","Query Tool"],"programFiles":["https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/misc/file_manager/__init__.py","https://github.com/pgadmin-org/pgadmin4/blob/master/web/pgadmin/utils/__init__.py"],"versions":[{"status":"affected","version":"0","lessThan":"9.19","versionType":"custom"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path with get_abs_path(). Several callers then acted on a path they built differently, so the path checked and the path used could name different files:\n\n- Opening a file in the Query Tool, the Google client secret and, on Windows, Import/Export Data, Backup, Restore and saving a file joined the path to the storage directory after stripping leading slashes and backslashes. On POSIX a path checked as a name inside storage could become an absolute path once stripped, so any file the pgAdmin account can read could be opened; on Windows a path naming a drive discarded the storage directory, so these could read, or write, outside it.\n- Listing a folder decoded the path a second time after the check, so a folder named like an encoded \"..\", which a user can create, listed any directory on the host.\n- Download, delete, rename and the file-exists check appended the path to the storage directory without a separator, so in a deployment where one user's storage directory name is a prefix of another's, another user's files could be read, deleted or moved; download also checked the path appended to itself.\n- Creating a folder could create one in another user's directory.\n\nThe fix makes check_access_permission() return the path it checked and every caller act on that path, decodes folder paths once, and opens, deletes and renames files relative to directories opened from the storage directory without following symbolic links. Desktop mode is not affected.\n\nThis issue affects pgAdmin 4: before 9.19."}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/10674","tags":["issue-tracking"]},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/ad6c028cff625a095676065767c7b80219205d28","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"Scored for the worst variant, which needs only an authenticated user in server mode: reading any file the pgAdmin account can read through the Query Tool's file open, and listing any directory. Attack Complexity is Low. Confidentiality is High because that includes pgAdmin's own configuration and database. Integrity is None for this variant; the read, delete and rename of another user's files need a deployment where one user's storage directory name is a prefix of another's, and the write outside storage is limited to Windows server mode. Scope is Unchanged: the access is with the authority of the pgAdmin account."}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":6.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"Same reasoning as the CVSS 3.1 entry. AT:N for the any-file read, which needs no deployment condition. VC:H; no subsequent-system impact is claimed."}],"cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","baseScore":7.1,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","cweId":"CWE-22","type":"CWE"},{"lang":"en","description":"CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition","cweId":"CWE-367","type":"CWE"}]}],"credits":[{"lang":"en","value":"Ashesh Vashi <ashesh.vashi@enterprisedb.com>","type":"remediation developer"},{"lang":"en","value":"Hitesh Jambhale <hitesh.jambhale@enterprisedb.com>","type":"remediation reviewer"}],"source":{"discovery":"INTERNAL"}}}}