CVE-2026-7816
OS Command Injection in pgAdmin 4 Import/Export
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: PostgreSQL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pgadmin | pgadmin_4 | to 9.15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7816 is an OS command injection vulnerability in the Import/Export query export feature of pgAdmin 4. It occurs because user-supplied input is directly inserted into a psql \copy metacommand template without proper sanitization.
An authenticated attacker can exploit this by injecting malicious commands that break out of the \copy context, allowing arbitrary command execution on the pgAdmin server or arbitrary file writes.
Additional fields such as format, on_error, and log_verbosity were also vulnerable due to raw interpolation.
The vulnerability affects pgAdmin 4 versions from 9.4 up to but not including 9.15. The fix includes implementing a parentheses-balance parser, allow-listing valid values for certain fields, rejecting null bytes in queries, and tightening type and gating checks.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an authenticated user to execute arbitrary operating system commands on the pgAdmin server.
Such arbitrary command execution can lead to unauthorized access, data manipulation, or disruption of services.
Additionally, the attacker could write arbitrary files on the server, potentially leading to further compromise or data leakage.
Overall, this can result in a high-severity security breach affecting the confidentiality, integrity, and availability of the system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade pgAdmin 4 to version 9.15 or later, where the issue has been fixed.
The fix includes implementing a parentheses-balance parser, allow-listing valid values for the format, on_error, and log_verbosity fields, rejecting null bytes in queries, and tightening type and gating checks.
Ensure that only authenticated and trusted users have access to the Import/Export query export feature until the upgrade is applied.