Path Traversal Vulnerability in pgAdmin 4 by pgAdmin Team

CVE-2026-7819

What is CVE-2026-7819?

A path traversal vulnerability in the file manager of pgAdmin 4 allows authenticated users to manipulate symbolic links within their storage directories. The flawed access permission validation using os.path.abspath fails to resolve symbolic links, enabling users to redirect file writes to arbitrary locations. This security flaw can potentially expose sensitive file paths to unauthorized access, allowing misuse of pgAdmin 4's functionalities. The issue has been addressed in subsequent releases, where the access checks are strengthened using os.path.realpath, along with a hardened file mode to prevent unauthorized file access.

References