CVE-2026-116243
Description
A flaw was found in pgadmin4. This vulnerability allows an authenticated attacker to achieve arbitrary code execution on the underlying server. When running in server mode, pgAdmin fails to prevent user-configured utility binary paths from pointing to shared storage directories where users can upload files. An attacker can exploit this issue by uploading an executable file to shared storage and directing pgAdmin to run it, executing code with the privileges of the operating system account running pgAdmin.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to disallow utility binary path configuration from pointing to user-writable shared storage locations in pgAdmin server mode: upgrade to pgAdmin 4 9.19, which reject utility binary paths located under or pointing to any SHARED_STORAGE directory after expanding variables, collapsing relative dots, resolving symlinks, and checking for NUL bytes or case-folding collisions, closing all 2 injection vectors (preference utility binary path pointing to SHARED_STORAGE, uploaded executable execution via PSQL, backup, or restore utility triggers). Until patched, this is only a concern on pgAdmin 4 server mode deployments, especially on Windows or environments where shared storage files permit execution — standard POSIX and Red Hat Enterprise Linux deployments where web-created files lack execute permissions are unaffected — so restrict authenticated users from uploading files into SHARED_STORAGE directories and ensure shared storage filesystems enforce noexec mount options where supported. As a compensating measure, deploy Windows Defender Application Control in enforced mode to block unauthorized binaries invoked by pgAdmin, confine pgAdmin utility binary resolution strictly to authorized system utility directories, blocking references to shared storage paths, reject the upload of executable file types or binary payloads into shared storage directories, and restrict path characters and enforce an allowlist of approved utility paths instead of relying on denylisting storage paths. These controls limit blast radius and contain exploitation, but they do not fix the underlying untrusted search path defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Access Control
Technical Impact: Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands
There is the potential for arbitrary code execution with privileges of the vulnerable program. If the product uses a search path to locate critical resources such as programs or libraries, then an attacker could modify that search path to point to a malicious program/library, which the targeted product would then execute.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The program could be redirected to the wrong files, potentially triggering a crash or hang when the targeted file is too large or does not have the expected format.
Confidentiality
Technical Impact: Read Files or Directories
The program could access unauthorized data and send the output of unauthorized files to the attacker.
Other
Technical Impact: Varies by Context
The problem extends to any type of critical resource that the product trusts. For example, the attacker could modify configuration in unexpected ways.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
