Abdel Adim Oisfi

VM images built with Kubernetes Image Builder Nutanix or OVA providers may use default credentials for Windows images if a user does not override them.

The issue is related to a path-traversal vulnerability in the session handling code of pgAdmin, which can lead to unsafe deserialization and remote code execution. This vulnerability can be exploited by an unauthenticated attacker on Windows or an authenticated attacker on POSIX/Linux systems, allowing them to gain code execution. The vulnerability is associated with the incorrect serialization of the `pga4 session` cookie file.