File Manager Security Flaw in pgAdmin 4 by pgAdmin Team
CVE-2026-86861

6MEDIUM

Key Information:

Vendor

Pgadmin.org

Status
Pgadmin 4
Vendor
CVE Published:
17 September 2026

What is CVE-2026-86861?

A vulnerability in pgAdmin 4's File Manager allows exploitation through the save_file endpoint, where the path validation and file writing processes are not properly secured against symbolic link substitution. Affected users may inadvertently overwrite arbitrary files due to a timing issue between the permission check and the subsequent file write operation. The vulnerability primarily needs the attacker to have filesystem access or to create symbolic links within the user's storage directory. Mitigation was implemented to enforce O_NOFOLLOW protection for the save_file process, aligning it with the existing upload functionality, while also enhancing file permissions for created files.

Affected Version(s)

pgAdmin 4 0 < 9.18

References

https://github.com/pgadmin-org/pgadmin4/issues/10385
issue-tracking

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sec-rex <secrex837@gmail.com>
Dave Page <dpage@pgadmin.org>
Ashesh Vashi <ashesh.vashi@enterprisedb.com>
.