pgAdmin 4 Path Traversal (CVE-2026-7819) Allows Arbitrary File Writes

The National Vulnerability Database (NVD) has detailed CVE-2026-7819, a high-severity symbolic-link path traversal vulnerability in pgAdmin 4’s File Manager. This flaw, rated 8.1 CVSS, allows an authenticated attacker to write to arbitrary paths on the server. The issue stems from an incomplete access check that used os.path.abspath, which correctly resolves .. (parent directory traversal) but fails to resolve symbolic links.

An attacker could plant a symbolic link within their own storage directory. This link, pointing outside the intended directory, would then be followed by the kernel during a subsequent write operation initiated by pgAdmin. This effectively allows the attacker to trick pgAdmin into writing to any path reachable by the pgAdmin process, bypassing security controls.

The fix, according to the NVD, involves switching the access check to os.path.realpath for both source and destination paths. Additionally, a new helper function, _open_upload_target, opens the target with O_NOFOLLOW and hardens the file mode from 0o644 to 0o600. This closes a critical Time-of-Check-Time-of-Use (TOCTOU) window between the access check and the actual file open operation. The vulnerability affects pgAdmin 4 versions prior to 9.15.