CVE-2026-7816
OS Command Injection in pgAdmin 4 Import/Export
Publication date: 2026-05-11
Last updated on: 2026-05-26
Assigner: PostgreSQL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pgadmin | pgadmin_4 | From 9.4 (inc) to 9.15 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-7816 is an OS command injection vulnerability in the Import/Export query export feature of pgAdmin 4. It occurs because user-supplied input is directly inserted into a psql \copy metacommand template without proper sanitization.
An authenticated attacker can exploit this by injecting malicious commands that break out of the \copy context, allowing arbitrary command execution on the pgAdmin server or arbitrary file writes.
Additional fields such as format, on_error, and log_verbosity were also vulnerable due to raw interpolation.
The vulnerability affects pgAdmin 4 versions from 9.4 up to but not including 9.15. The fix includes implementing a parentheses-balance parser, allow-listing valid values for certain fields, rejecting null bytes in queries, and tightening type and gating checks.
How can this vulnerability impact me? :
This vulnerability can have severe impacts because it allows an authenticated user to execute arbitrary operating system commands on the pgAdmin server.
Such arbitrary command execution can lead to unauthorized access, data manipulation, or disruption of services.
Additionally, the attacker could write arbitrary files on the server, potentially leading to further compromise or data leakage.
Overall, this can result in a high-severity security breach affecting the confidentiality, integrity, and availability of the system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade pgAdmin 4 to version 9.15 or later, where the issue has been fixed.
The fix includes implementing a parentheses-balance parser, allow-listing valid values for the format, on_error, and log_verbosity fields, rejecting null bytes in queries, and tightening type and gating checks.
Ensure that only authenticated and trusted users have access to the Import/Export query export feature until the upgrade is applied.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves OS command injection through the Import/Export query export feature in pgAdmin 4, specifically via user-supplied input interpolated into a psql \copy metacommand template without sanitization.
To detect exploitation attempts on your system or network, you should monitor for unusual or suspicious psql \copy commands that include injected payloads such as ") TO PROGRAM 'cmd'" or ") TO '/path'" patterns.
Since the vulnerability requires authenticated access, reviewing pgAdmin 4 logs for abnormal query export commands or unexpected file writes or command executions can help identify attempts.
Example commands to search for suspicious activity might include:
- Using grep to find suspicious \copy commands in pgAdmin logs: grep -E '\\copy.*\) TO PROGRAM|\\copy.*\) TO ' /path/to/pgadmin/logs/*
- Monitoring active psql sessions for unusual \copy commands: SELECT * FROM pg_stat_activity WHERE query LIKE '%\copy%TO PROGRAM%' OR query LIKE '%\copy%TO %';
- Checking for unexpected files created or modified by pgAdmin processes in the filesystem.
Note that no specific detection commands are provided in the resources, so these suggestions are based on the nature of the vulnerability and typical monitoring practices.