Backup Tool Vulnerability in pgAdmin 4 by pgAdmin Group

CVE-2026-86864

What is CVE-2026-86864?

The Backup tool in pgAdmin 4 is susceptible to a vulnerability that allows authenticated users to manipulate the database name input, resulting in significant security risks. Specifically, the appends the user-supplied 'database' field to the pg_dump argument without validation. This oversight enables an attacker to use options starting with a dash, potentially overriding the intended behavior of pg_dump and allowing arbitrary file creation outside the user’s storage area. Additionally, connection-string injection can occur, enabling malicious actors to redirect the pg_dump connection to attacker-controlled servers, exposing sensitive credentials. The issue affects pgAdmin 4 versions before 9.18, where the solution involves modifying how database names are processed to prevent such exploitation.

References