CVE-2026-7816: pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout
OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.
User-supplied input was interpolated directly into a psql \copy metacommand template without sanitization. An authenticated user could inject ") TO PROGRAM 'cmd'" to break out of the \copy (...) context and achieve arbitrary command execution on the pgAdmin server, or ") TO '/path'" for arbitrary file write. Additional fields (format, onerror, logverbosity) were also raw-interpolated and exploitable.
Fix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/onerror/logverbosity, rejects null bytes in the query, and tightens type and gating checks.
This issue affects pgAdmin 4: before 9.15.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pgAdmin 4to a version that resolves this vulnerability.Fixed in 9.15 - Configuration
Upgrade pgAdmin 4 to apply the fix: use a parens-balance parser (modeled on psql's strtokx tokenizer) for the psql \copy metacommand template, allow-list format/on_error/log_verbosity, reject null bytes in the query, and tighten type and gating checks to prevent psql metacommand breakout.
pgAdmin 4 Import/Export (query export) Input handling for format/on_error/log_verbosity = allow-listed and parsed with a parens-balance parser modeled on psql's strtokx tokenizer; reject null bytes in the query
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7816?
CVE-2026-7816 has a high severity rating of 8.7.
How do I fix CVE-2026-7816?
You can fix CVE-2026-7816 by applying the available patch from pgAdmin.
What kind of vulnerability is CVE-2026-7816?
CVE-2026-7816 is an OS command injection vulnerability.
Can CVE-2026-7816 be exploited without authentication?
No, CVE-2026-7816 requires an authenticated user to exploit the vulnerability.
What impact does CVE-2026-7816 have on data security?
CVE-2026-7816 allows an attacker to potentially execute arbitrary commands on the server, compromising data security.