Vulnerability · Published May 11, 2026 · Assigned by PostgreSQL

CVE-2026-7819pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write

High 8.1

In plain English

A high-severity security flaw in pgAdmin 4 from pgadmin.org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 74.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage directory pointing outside it and induce pgAdmin to write to any path reachable by the pgAdmin process. Fix switches the access check to os.path.realpath for both source and destination, and adds an _open_upload_target helper that opens the target with O_NOFOLLOW (mode 0o600) to close the leaf-component TOCTOU between the access check and the open. File mode is hardened from 0o644 to 0o600. This issue affects pgAdmin 4: before 9.15.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	pgadmin4	9.15	GHSA-hr4r-fwpv-c95j
PyPI	pgadmin4	9.15	PYSEC-2026-2868

Affected products (as reported)

Vendor	Product	Versions
pgadmin.org	pgAdmin 4	0 – before 9.15

Weakness: CWE-61 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

https://github.com/pgadmin-org/pgadmin4/issues/9902 issue-tracking