{"id":"CVE-2026-116250","aliases":[],"cve":{"records":[{"id":"CVE-2026-116250","source":"PostgreSQL","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-25T16:26:16.420Z","published":"2026-10-30T19:55:18.713Z","modified":"2026-10-30T19:55:18.713Z"}],"publishers":[{"name":"PostgreSQL","role":"CNA","organizationId":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","modified":"2026-10-30T19:55:18.713Z"}],"references":[{"url":"https://github.com/pgadmin-org/pgadmin4/issues/10647","tags":["issue-tracking"],"source":"PostgreSQL"},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/99f5606e2ebc7c94c7acdbab877ce7de54bfc756","tags":["patch"],"source":"PostgreSQL"},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/c4321b9968342716f34bc5f10de6cac3c0567e68","tags":["patch"],"source":"PostgreSQL"},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/730d1e783c339ec696a1f77f2eee6f4b52cb6c37","tags":["patch"],"source":"PostgreSQL"}],"weaknesses":[{"id":"CWE-367","description":"CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition","source":"PostgreSQL"},{"id":"CWE-59","description":"CWE-59 Improper Link Resolution Before File Access ('Link Following')","source":"PostgreSQL"}],"applicability":[],"prioritization":[]},"title":"pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check","titleSource":"PostgreSQL","descriptionSource":"PostgreSQL","description":"In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it with a plain open() or handed the path to a utility that opened it later: the servers.json export and import and the import file listing, and the files given to pg_dump, pg_dumpall, pg_restore and psql by Backup, Restore and Import/Export Data. A symbolic link swapped in at the file or at any parent directory between the check and the open redirected the operation outside the storage directory, so a file could be written, overwritten or read, or loaded into a table, as the operating-system account running pgAdmin. A hard link to an outside file, which O_NOFOLLOW does not detect, and a FIFO, which could hang a request, had the same effect. CVE-2026-86861 fixed this for the File Manager's save_file; these were the remaining paths.\n\nExploitation requires creating such a link or FIFO inside the user's storage directory. pgAdmin offers no way to do so, and the per-user storage directories belong to the pgAdmin account, so this requires write access to the storage backend as a different operating-system user, for example a shared or network-mounted storage directory, and winning the race.\n\nThe fix opens each file by walking down from the storage directory one component at a time with O_NOFOLLOW, accepting only a regular file with one link, and passes the utilities the open descriptor (/dev/fd/N) on Linux. Error messages no longer include the server path.\n\nThis issue affects pgAdmin 4: before 9.19.","score":7.3,"severity":"high","published":"2026-10-30T19:55:18.713Z","modified":"2026-10-30T19:55:18.713Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"pgadmin.org","name":"pgAdmin 4","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"9.19","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"PostgreSQL","url":"https://www.cve.org/CVERecord?id=CVE-2026-116250"}],"remediation":[],"references":["https://github.com/pgadmin-org/pgadmin4/issues/10647","https://github.com/pgadmin-org/pgadmin4/commit/99f5606e2ebc7c94c7acdbab877ce7de54bfc756","https://github.com/pgadmin-org/pgadmin4/commit/c4321b9968342716f34bc5f10de6cac3c0567e68","https://github.com/pgadmin-org/pgadmin4/commit/730d1e783c339ec696a1f77f2eee6f4b52cb6c37"],"sources":[{"name":"CVE","id":"CVE-2026-116250","modified":"2026-10-30T19:55:18.713Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116250"}],"assessments":[{"source":"PostgreSQL","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","score":6.5},{"source":"PostgreSQL","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","score":7.3}],"sourceAffected":[],"observedAt":"2026-10-30T20:24:48.714Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T03:10:30.875Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":null}