pgAdmin 4 CVE-2026-86861

Requires: (1) an authenticated pgAdmin user able to invoke the File Manager save_file endpoint via the Query Tool or ERD (PR:L); AND (2) the ability to create or replace a symbolic link inside that user's storage directory - pgAdmin exposes no symlink-creation interface, so this mandates filesystem access to the pgAdmin host or to a shared/network-mounted storage backend; AND (3) winning the narrow TOCTOU timing window between check_access_permission() and the plain open() write. Limiting factors: exploitation is confined to pgAdmin 4 versions before 9.18; the race is hard to win (reporter failed ~63,000 attempts on a released build); a symlink already present when the check runs is rejected, so only a link substituted at the final path component during the window works; intermediate-directory substitution is out of scope. A default single-host deployment where no other party can write to the storage directory is effectively not exploitable.

This is a genuine but low-priority defect. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L, score 5.9) already signals the tension: although scored as network-reachable, the actual exploit requires an out-of-band prerequisite the vector cannot express - the attacker must be able to create or replace a symbolic link inside the requesting user's storage directory, meaning filesystem access to the pgAdmin host or a shared/network-mounted storage backend. AC:H is well justified: this is a classic TOCTOU (CWE-367) race between check_access_permission() and the plain open(), and the reporter explicitly failed to win it - roughly 63,000 racing requests produced no successful arbitrary write against a released build. No EPSS, KEV, or SSVC data is supplied, and there is no public exploit; the referenced material is a project issue tracker, not weaponized code. Net: I:H would be serious if reliably reachable, but the combination of a hard-to-win race plus a mandatory local/shared-filesystem foothold makes real-world exploitability marginal. Treat as a defense-in-depth hardening fix, not an urgent patch - the vendor characterizes it as an uncovered write path rather than a demonstrated sandbox escape.

An attacker who already has an authenticated pgAdmin session (PR:L) and separate filesystem access to a shared or network-mounted storage backend triggers a save from the Query Tool or ERD, then races to swap a symlink into the final path component after check_access_permission() passes but before the plain open() writes. Winning the window makes pgAdmin follow the link and create or overwrite an arbitrary file as the OS account running pgAdmin. No public exploit exists, and the original reporter could not achieve a write in ~63,000 attempts against a released version.