Read the docs
TI-2022-03867 Aliases CVE-2022-4223GHSA-3v6v-2x6p-32mc

Code injection in pgadmin4

Priority HIGH 78CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-94 and CWE-862.

Summary

The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.80069 99th percentileScored 2026-11-07
Fix Fixed pgadmin4 (PyPI): 6.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—pgadmin4pgadmin4 6.17—No fix listedCNA
—pgadmin4 (PyPI)before 6.176.17Patch availableGHSA-3v6v-2x6p-32mc
  • pgadmin4 Vendor— Affected pgadmin4 6.17 Fixed in — No fix listed CNA
  • pgadmin4 (PyPI) Vendor— Affected before 6.17 Fixed in 6.17 Patch available GHSA-3v6v-2x6p-32mc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*before 6.17Vulnerablepgadmin.org
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
  • cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* Versions before 6.17 Vulnerable ·pgadmin.org
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-3v6v-2x6p-32mc pgadmin4 (PyPI) Fixed in 6.17 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4223
  2. 2026-10-03 Alias added: GHSA-3v6v-2x6p-32mc

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences