pgAdmin 4 CVE-2026-7818

Exploitation requires three specific prerequisites: (1) Valid authentication to pgAdmin 4 as any user role-no privilege escalation within pgAdmin is needed beyond basic authenticated access. (2) Filesystem write permission to the pgAdmin sessions directory, typically /var/lib/pgadmin/sessions/ or configured SERVER_MODE session path-achievable through world-writable directory misconfiguration (chmod 777 or 775 with attacker in group), container volume mount permissiveness, or chaining with a separate path-traversal or arbitrary-file-write vulnerability in pgAdmin or underlying web server. (3) pgAdmin 4 version earlier than 9.15 using FileBackedSessionManager (default for file-based sessions). Attack vector is local (AV:L) meaning the attacker needs shell access to the server filesystem, not just HTTP access to pgAdmin web interface, limiting remote-only attack scenarios. The AC:H (high complexity) rating reflects that write access to a protected system directory requires either administrative error or exploitation of an additional vulnerability, not standard pgAdmin functionality. Database-backed session configurations are not affected.

Real-world risk is elevated for multi-tenant or shared-hosting pgAdmin deployments but constrained by multiple prerequisites. CVSS 7.0 (High) reflects local attack vector (AV:L), high attack complexity (AC:H), and low privileges required (PR:L). The AC:H rating correctly captures that exploitation demands both authenticated access AND filesystem write permission to sessions directory-not achievable in typical single-admin PostgreSQL environments with proper file permissions. EPSS score unavailable, but the attack chain complexity (requiring privilege escalation or configuration error) suggests targeted rather than opportunistic exploitation. Not present in CISA KEV, indicating no confirmed widespread active exploitation. The severity is real for environments with: (1) web-accessible pgAdmin with multiple user accounts, (2) misconfigured session-directory permissions (world-writable or group-writable), or (3) unpatched path-traversal bugs allowing arbitrary file writes. Organizations running pgAdmin in containerized/isolated environments with principle-of-least-privilege filesystem controls face materially lower risk than CVSS suggests. Priority should escalate for pgAdmin instances exposed to untrusted authenticated users or deployed on shared infrastructure.

An attacker with valid pgAdmin credentials leverages misconfigured world-writable permissions on /var/lib/pgadmin/sessions/ (common in quick-start Docker deployments with volume mount errors). They generate a malicious Python pickle payload embedding os.system() calls to establish reverse shell, serialize it to a crafted session file matching pgAdmin's naming convention, and write it to the sessions directory. When pgAdmin's FileBackedSessionManager attempts to load any session (including the planted file during periodic cleanup or user session lookup), the unsafe pickle.load() executes the embedded payload before HMAC validation, granting the attacker shell access as the postgres or pgadmin process user with database administrative privileges.