pgAdmin 4 EUVD-2026-114381

Requires pgAdmin 4 running in server (web, multi-user) mode - desktop mode is explicitly unaffected - and an authenticated pgAdmin account (PR:L). Concrete trigger surfaces named in the description: opening a file in the Query Tool, the Google client-secret path, and (Windows only) Import/Export Data, Backup, Restore and file-save, all of which strip leading slashes/backslashes so a path validated as a name inside storage becomes absolute (POSIX read-anywhere) or drops the storage directory for a drive letter (Windows read/write outside storage); folder listing, which decodes the path a second time after the check so a user-creatable folder named like an encoded '..' lists any host directory; and download/delete/rename/exists, which append the path without a separator so in deployments where one user's storage directory name is a PREFIX of another's, a second user's files can be read, deleted, or moved. Creating a folder can place it in another user's directory. Limiting factors: server mode only, valid account required, several high-impact variants are Windows-specific, and the download/delete/rename cross-user read requires the specific storage-directory-name-prefix condition in a multi-user deployment.

This is a moderate-severity, authenticated path traversal in pgAdmin 4 server mode, rated 7.1 (High) by the vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) - network-reachable and low-complexity, but requiring a valid pgAdmin account (PR:L), which materially limits mass, unauthenticated exploitation. No EPSS score is provided in the input, so exploitation probability cannot be quantified; the vuln is NOT in CISA KEV and no working public exploit is identified. The vuln.today decision label is 'this_week', consistent with a real-but-not-emergency priority. A notable conflict exists between signals: the vendor vector sets VI:N (no integrity impact), yet the description explicitly documents writing outside the storage directory on Windows and deleting, renaming, and moving other users' files - these are integrity impacts the published vector under-reflects, so the real severity is arguably higher than 7.1 on the integrity axis. The public fix commit (ad6c028) discloses the mechanism in detail, which lowers the bar for an attacker to reverse-engineer a working exploit even though no PoC is published. Net: a genuine this-week priority for multi-user pgAdmin server-mode deployments, but not a drop-everything emergency given the authentication requirement and absence of KEV/active-exploitation evidence.

A low-privileged but authenticated user of a shared pgAdmin 4 server-mode instance submits a crafted file path (e.g., a POSIX path that resolves to an absolute location once leading slashes are stripped, or a folder name containing an encoded '..') through the Query Tool file open or folder-listing feature. Because the path that check_access_permission() validated differs from the path the caller actually opens, the attacker reads files anywhere the pgAdmin service account can access, lists arbitrary host directories, or reads/deletes/renames another tenant's files. No public exploit is identified at time of analysis, but the fix commit publicly reveals the flawed logic.