pgAdmin 4 EUVD-2026-29087

Requires authenticated access to pgAdmin 4 with a valid user account having File Manager permissions. The attacker must have the ability to create files and symbolic links within their allocated pgAdmin storage directory, which is standard functionality for authenticated users. Exploitation targets pgAdmin 4 deployments before version 9.15 running on UNIX-like operating systems where symbolic links are supported (Linux, BSD, macOS). Windows deployments may have different behavior with junction points and symlinks depending on filesystem and permissions. The pgAdmin process must have write permissions to the symlink target location for successful exploitation, meaning impact is bounded by the process's effective user privileges. No special network position, user interaction, or non-default configuration is required beyond basic authenticated access to the File Manager feature. Attack complexity is low (AC:L) because creating symlinks is a standard filesystem operation available to authenticated users.

CVSS 8.1 (High severity) reflects network-accessible attack with low complexity requiring only low-privileged authentication. The AV:N/AC:L/PR:L/UI:N vector indicates any authenticated pgAdmin user can exploit this remotely without special conditions. Impact is limited to Integrity and Availability (I:H/A:H) with no direct Confidentiality impact (C:N), suggesting file overwrites rather than reads. However, overwriting configuration files or executables can lead to code execution, making the real-world impact potentially more severe. EPSS data not provided, but the technical barrier is low for authenticated insiders. No CISA KEV listing indicates no confirmed active exploitation in the wild. The PostgreSQL project published detailed remediation information including the exact vulnerable code patterns and fix implementation on GitHub issue #9902, which serves as a precise exploit blueprint. Primary risk is to organizations with untrusted authenticated pgAdmin users (shared hosting, multi-tenant environments, or compromised credentials). Single-administrator deployments face lower risk unless credentials are compromised. The S:U (unchanged scope) means exploitation is contained to pgAdmin's security context, but pgAdmin typically runs with database administrator privileges, making file system writes highly dangerous. Priority should be HIGH for multi-user pgAdmin deployments and MEDIUM for single-admin instances with strong credential controls.

An authenticated user with valid pgAdmin credentials logs into the web interface and navigates to their storage directory in the File Manager. They create a symbolic link named 'config.txt' pointing to /opt/pgadmin/config_system.py or another critical application file. Through the File Manager upload or write functionality, they trigger pgAdmin to write malicious content to 'config.txt'. The access control check validates the symlink path as within the user's authorized directory, but the actual write operation follows the symlink and overwrites the target system configuration file. The attacker then triggers execution of the modified configuration to achieve persistence or privilege escalation. Given the detailed fix description in the public GitHub issue, constructing a working exploit requires only basic Python and filesystem knowledge.