Deserialization Vulnerability in pgAdmin 4 FileBackedSessionManager
CVE-2026-7818

7.3HIGH

Key Information:

Vendor

Pgadmin.org

Status
Pgadmin 4
Vendor
CVE Published:
11 May 2026

What is CVE-2026-7818?

A vulnerability in pgAdmin 4's FileBackedSessionManager allows for unsafe deserialization of session data. The session manager fails to perform a proper HMAC integrity check before deserializing session files. This oversight permits an authenticated user, with write access to the sessions directory, to introduce a malformed serialized payload, potentially leading to remote code execution with the privileges of the pgAdmin process. The implementation of a protection mechanism involves prepending a hex SHA-256 HMAC to the session data, verified before deserialization, which mitigates this issue in later versions.

Affected Version(s)

pgAdmin 4 0

References

https://github.com/pgadmin-org/pgadmin4/issues/9901
issue-tracking

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fernando Bortotti
.