Postgresql Global Development Group
Symlink following in `pg basebackup` plain format and in `pg rewind` allows an origin superuser to overwrite local files, such as '/var/lib/postgres/.bashrc', which can lead to the hijacking of the operating system account. This issue has practical implications if actions are taken between the execution of these commands and the server start, such as moving files to a different virtual machine or snapshotting the virtual machine.