TI-2026-06878 Aliases CVE-2026-7816 GHSA-j74f-g7vx-fh4x

pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout

MEDIUM 43CWE-78Published 2026-05-11 · Updated 2026-05-26

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution, SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78 and CWE-89.

Summary

OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a psql \copy metacommand template without sanitization. An authenticated user could inject ") TO PROGRAM 'cmd'" to break out of the \copy (...) context and achieve arbitrary command execution on the pgAdmin server, or ") TO '/path'" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable. Fix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks. This issue affects pgAdmin 4: before 9.15.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01444 73rd percentileScored 2026-11-07

Fix Fixed pgAdmin 4 (pgadmin.org): 9.15pgadmin4 (PyPI): 9.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pgadmin.org	pgAdmin 4	9.4 to before 9.15	9.15	Patch available	CNA
—	pgadmin4 (PyPI)	before 9.15	9.15	Patch available	GHSA-j74f-g7vx-fh4x

pgAdmin 4 Vendorpgadmin.org Affected 9.4 to before 9.15 Fixed in 9.15 Patch available CNA
pgadmin4 (PyPI) Vendor— Affected before 9.15 Fixed in 9.15 Patch available GHSA-j74f-g7vx-fh4x

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pgadmin:pgadmin_4::::::postgresql::*	9.4 to before 9.15	Vulnerable	pgadmin.org

cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* Versions 9.4 to before 9.15 Vulnerable ·pgadmin.org

Remediation

Fix · CNA pgAdmin 4 (pgadmin.org) Fixed in 9.15
Fix · GHSA-j74f-g7vx-fh4x pgadmin4 (PyPI) Fixed in 9.15 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-05-11
pgadmin.org pgAdmin 4 9.15
8 records Highest priority Priority HIGH 1 HIGH, 3 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2026-06875 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server modePriority HIGH 76
- TI-2026-06876 pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain VisualizerPriority MEDIUM 55
- TI-2026-06877 pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code executionPriority MEDIUM 40
Show all 8 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-7816
2026-10-03 Alias added: GHSA-j74f-g7vx-fh4x

References

Patch 1

https://github.com/pgadmin-org/pgadmin4/issues/9899

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-7816

Other 2

TI-2024-01901 Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 CVSS 3.1CRITICAL 9.9
TI-2024-02918 Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 CVSS 3.1CRITICAL 9.8
TI-2022-03867 Code injection in pgadmin4 CVSS 3.1HIGH 8.8
TI-2026-06875 pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode CVSS 4.0CRITICAL 9.4
TI-2025-02572 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment CVSS 3.1CRITICAL 9.9
TI-2023-00228 Path traversal in pgadmin CVSS 3.1MEDIUM 6.5

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences