pgAdmin 4 CVE-2026-116250

Requires a server-mode pgAdmin deployment where a user's per-user storage directory sits on a backend writable by a different operating-system user - explicitly a shared or network-mounted storage directory - because pgAdmin exposes no primitive to create symlinks, hard links, or FIFOs and the storage directories are owned by the pgAdmin account. The attacker must plant such a link or FIFO at the target file or any parent directory and then win the race between check_access_permission() and the subsequent open during a servers.json import/export, import file listing, or a Backup/Restore/Import-Export Data operation that invokes pg_dump, pg_dumpall, pg_restore, or psql. Exploitation is limited by the need for authenticated pgAdmin access (PR:L), the non-default shared-storage configuration, and successfully winning the TOCTOU race; a FIFO variant yields request hang (availability) rather than file read/write.

This is a moderate, conditional risk rather than an urgent widespread threat. The CVSS 4.0 vector (AV:L/AC:H/AT:P/PR:L/UI:N) and the 7.3 score are driven by high confidentiality and integrity impact (VC:H/VI:H), but the local attack vector, high complexity, and present attack requirement (AT:P) reflect a genuine TOCTOU race that is hard to win. No KEV listing and no EPSS score were supplied, so there is no signal of active or probable exploitation; exploitation status is no public exploit identified at time of analysis. The references are the upstream fix commits and the tracking issue - not exploit code - so this should not be read as a weaponized bug. The vuln.today priority is this_week, consistent with a real but non-emergency server-side flaw. The key limiting factor, explicit in the description, is that pgAdmin itself offers no way to create the required link or FIFO and the per-user storage directories are owned by the pgAdmin account; exploitation therefore presupposes a second OS user with write access to the storage backend (e.g. shared or network-mounted storage). That precondition, plus the race, makes this far lower real-world risk than the raw high-impact metrics suggest for typical single-tenant deployments. Note PR:L (authenticated pgAdmin user) is the stated authentication level.

In a server-mode pgAdmin deployment whose per-user storage lives on shared or network-mounted storage, a second operating-system user who can write into that storage directory plants a symbolic link, hard link, or FIFO at a path a pgAdmin user will act on. Between pgAdmin's check_access_permission() validation and the later open(), the attacker swaps the link in so a Backup/Restore/Import-Export or servers.json operation reads, writes, or overwrites a file outside the storage directory as the pgAdmin OS account. No public exploit was identified; success also depends on winning the check-to-open race.