Akshay-Joshi

**Name of the Vulnerable Software and Affected Versions** pgAdmin version 9.11 **Description** pgAdmin version 9.11 is susceptible to a restriction bypass issue during restore operations when running in server mode and processing PLAIN-format dump files. An attacker with access to the pgAdmin web interface can potentially extract the `restrict` key during an active restore operation. This allows the attacker to race the restore process by overwriting the restore script with a payload that re-enables meta-commands using `unrestrict <key>`, leading to potential command execution on the pgAdmin host during the restore operation. The vulnerable operation involves restoring from PLAIN-format dump files. **Recommendations** Apply a fix or update to a version newer than 9.11. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pgAdmin versions prior to 6.17 **Description** The pgAdmin server includes an HTTP API intended to validate the path a user selects to external PostgreSQL utilities such as pg dump and pg restore. This API is used to determine the PostgreSQL version by executing the utility. However, versions of pgAdmin prior to 6.17 failed to properly secure this API, allowing an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This could cause an appropriately named executable in the target path to be executed by the pgAdmin server. **Recommendations** For versions prior to 6.17, update to version 6.17 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP API to minimize the risk of exploitation.