CVE-2026-7816

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.15

Description An OS command injection issue exists in the Import/Export query export feature. Authenticated users can exploit this by providing unsanitized input that is interpolated directly into a psql copy metacommand template. This allows an attacker to break out of the command context to execute arbitrary commands on the pgAdmin server or perform arbitrary file writes. Additionally, the format, on error, and log verbosity fields are susceptible to raw interpolation and exploitation.

Recommendations Update to version 9.15 or later. Restrict access to the Import/Export query export feature for authenticated users until the update is applied.