CVE-2026-7816

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-7816
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7816.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-7816
Aliases
Related
Published
2026-05-11T14:35:50.827Z
Modified
2026-07-15T01:49:04.655218757Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout
Details

OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.

User-supplied input was interpolated directly into a psql \copy metacommand template without sanitization. An authenticated user could inject ") TO PROGRAM 'cmd'" to break out of the \copy (...) context and achieve arbitrary command execution on the pgAdmin server, or ") TO '/path'" for arbitrary file write. Additional fields (format, onerror, logverbosity) were also raw-interpolated and exploitable.

Fix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/onerror/logverbosity, rejects null bytes in the query, and tightens type and gating checks.

This issue affects pgAdmin 4: before 9.15.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7816.json",
    "cna_assigner": "PostgreSQL"
}
References

Affected packages

Git / github.com/pgadmin-org/pgadmin4

Affected ranges

Type
GIT
Repo
https://github.com/pgadmin-org/pgadmin4
Events
Introduced
7c74b7cdb764d54ba7f42e0644b3f1d3ee7c786f
Fixed
86a8b165abbefd62e78fd43edcd66c0d09649442
Database specific 
{
    "cpe": "cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*",
    "extracted_events": [
        {
            "introduced": "9.4"
        },
        {
            "fixed": "9.15"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

Other
REL-9_10
REL-9_11
REL-9_12
REL-9_13
REL-9_14
REL-9_4
REL-9_5
REL-9_6
REL-9_7
REL-9_8
REL-9_9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7816.json"