CVE-2026-116249: pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory

Published Oct 30, 2026

Updated

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath() only stripped leading slashes before joining the two. A path such as "../<another user>/.pgpass", set through the server dialog, the REST API or a servers.json import, therefore named another user's file, and connecting used that user's saved passwords, client certificate or SSH key. The sslkeylogfile connection parameter was passed to libpq unchanged, so a path outside storage let libpq create or append a file as the account running pgAdmin.

makeconninfo() also quoted connection parameter values but not their names, so a crafted parameter name could smuggle additional keyword=value pairs past these checks.

The fix requires the resolved path, with symbolic links followed, to stay inside the user's storage directory or the named shared storage directory, confines sslkeylogfile the same way, and accepts only exact libpq keywords as connection parameter names. A refused path or keyword is reported instead of letting libpq fall back to a default.

This issue affects pgAdmin 4: before 9.19.

Event History

Oct 30, 2026

CVE Published

via MITRE·07:55 PM

Data Sourced

via MITRE·07:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Server-mode pgAdmin 4 deployments are affected if they run a version before 9.19. The issue concerns file paths and connection parameters supplied through the server dialog, REST API, or a servers.json import.

What level of access does an attacker need?

An attacker needs low-privileged access sufficient to create or modify a server connection definition or import one. Exploitation does not require user interaction, but the attack complexity is high.

What could an attacker do with a crafted connection definition?

They could reference another user's .pgpass file, client certificate, private key, CRL, or SSH tunnel identity file using a path traversal sequence. They could also cause libpq to create or append an sslkeylogfile outside the intended storage directory as the account running pgAdmin, or inject additional libpq connection parameters through a crafted parameter name.

How can administrators determine whether they may already be affected?

Review server definitions and servers.json imports for file paths containing traversal components such as ../, especially for password, SSL certificate, key, CRL, SSH identity, and sslkeylogfile settings. Also inspect connection parameter names for values that are not exact libpq keywords or that appear to contain injected keyword=value content.

What should be done if upgrading is not immediately possible?

Restrict who can create, edit, or import server connection definitions, and review existing definitions for traversal paths and abnormal parameter names. Treat access to the pgAdmin service account's files and other users' storage directories as potentially exposed until the affected deployment is upgraded.

CVE-2026-116249: pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What level of access does an attacker need?

What could an attacker do with a crafted connection definition?

How can administrators determine whether they may already be affected?

What should be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What level of access does an attacker need?

What could an attacker do with a crafted connection definition?

How can administrators determine whether they may already be affected?

What should be done if upgrading is not immediately possible?