{"id":"CVE-2026-116241","aliases":[],"cve":{"records":[{"id":"CVE-2026-116241","source":"PostgreSQL","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-25T16:26:16.419Z","published":"2026-10-30T19:55:13.194Z","modified":"2026-10-30T19:55:13.194Z"}],"publishers":[{"name":"PostgreSQL","role":"CNA","organizationId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","modified":"2026-10-30T19:55:13.194Z"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/10663","tags":["issue-tracking"],"source":"PostgreSQL"},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/9be31a019f780647fb689c458408c8803263c812","tags":["patch"],"source":"PostgreSQL"}],"weaknesses":[{"id":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","source":"PostgreSQL"},{"id":"CWE-115","description":"CWE-115 Misinterpretation of Input","source":"PostgreSQL"}],"applicability":[],"prioritization":[]},"title":"pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier","titleSource":"PostgreSQL","descriptionSource":"PostgreSQL","description":"pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \\copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, where it treated the next double quote as closing the identifier. psql's \\copy parser applies the connection's escape character to whichever quote opened a token, so with standard_conforming_strings off a backslash-escaped double quote does not close the identifier. pgAdmin's and psql's view of the quoting then diverged, a closing parenthesis hidden from the check ended the \\copy (...) wrapper, and a following TO PROGRAM clause was executed by psql on the pgAdmin host, as the operating-system account running pgAdmin, before the server rejected the statement. An ordinary database role can turn standard_conforming_strings off for itself, and the Import/Export Data permission is granted to non-administrators by default.\n\nThis is a bypass of the fix for CVE-2026-17566. The fix rejects any backslash inside a double-quoted identifier, as was already done for single-quoted strings, since its meaning depends on a server setting that cannot be known reliably when the query is validated.\n\nThis issue affects pgAdmin 4: before 9.19.","score":9.9,"severity":"critical","published":"2026-10-30T19:55:13.194Z","modified":"2026-10-30T19:55:13.194Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"pgadmin.org","name":"pgAdmin 4","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"9.19","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"PostgreSQL","url":"https://www.cve.org/CVERecord?id=CVE-2026-116241"}],"remediation":[],"references":["https://github.com/pgadmin-org/pgadmin4/issues/10663","https://github.com/pgadmin-org/pgadmin4/commit/9be31a019f780647fb689c458408c8803263c812"],"sources":[{"name":"CVE","id":"CVE-2026-116241","modified":"2026-10-30T19:55:13.194Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116241"}],"assessments":[{"source":"PostgreSQL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","score":9.9},{"source":"PostgreSQL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.4}],"sourceAffected":[],"observedAt":"2026-10-30T20:24:34.375Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:05:32.453Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}