CVE-2026-7819

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.15

Description A symbolic-link path traversal issue exists in the pgAdmin 4 File Manager. The check access permission() function utilized os.path.abspath, which resolves parent directory references but fails to resolve symbolic links. Because the subsequent kernel write operation follows symbolic links, an authenticated user can create a symbolic link within their own storage directory that points to an external location. This allows the user to induce pgAdmin to write to any path accessible by the pgAdmin process, potentially compromising the integrity and availability of protected information. This is a TOCTOU (Time-of-Check to Time-of-Use) race condition between the access check and the file open operation.

Recommendations Update to version 9.15 or later.