CVE-2026-7818

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-7818

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7818.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-7818

Aliases

Related

CGA-xv69-m2fc-3fwg

Published

2026-05-11T14:35:52.092Z

Modified

2026-07-15T01:48:56.157472053Z

Severity

7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution

Details

Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.

The session manager performed unsafe deserialization of session-file contents (using Python's standard object-serialization module) before performing any HMAC integrity check. Any file dropped into the sessions directory was deserialized unconditionally. An authenticated user with write access to the sessions directory (whether by misconfiguration or in combination with another path-traversal flaw) could plant a crafted serialized payload to achieve operating-system level remote code execution under the pgAdmin process identity.

Fix prepends a 64-byte hex SHA-256 HMAC over the session body, computed with SECRETKEY, and verifies it via hmac.comparedigest before any deserialization. The check is raised (rather than asserted) on empty SECRET_KEY so it is not stripped under -O.

This issue affects pgAdmin 4: before 9.15.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7818.json",
    "cna_assigner": "PostgreSQL"
}

References

Affected packages

Git / github.com/pgadmin-org/pgadmin4

Affected ranges

Type

GIT

Repo

https://github.com/pgadmin-org/pgadmin4

Events

Introduced

Fixed

86a8b165abbefd62e78fd43edcd66c0d09649442

Database specific

{
    "cpe": "cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.15"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

Other

REL-1_0

REL-1_0-BETA1

REL-1_0-BETA2

REL-1_0-BETA3

REL-1_0-BETA4

REL-1_0-RC1

REL-1_1

REL-1_2

REL-1_3

REL-1_4

REL-1_5

REL-1_6

REL-2_0

REL-2_0-RC1

REL-2_0-RC2

REL-2_1

REL-3_0

REL-3_1

REL-3_2

REL-3_3

REL-3_4

REL-3_5

REL-3_6

REL-4_0

REL-4_1

REL-4_10

REL-4_11

REL-4_12

REL-4_13

REL-4_14

REL-4_15

REL-4_16

REL-4_17

REL-4_18

REL-4_19

REL-4_2

REL-4_20

REL-4_21

REL-4_22

REL-4_23

REL-4_24

REL-4_25

REL-4_26

REL-4_27

REL-4_28

REL-4_29

REL-4_3

REL-4_30

REL-4_4

REL-4_5

REL-4_6

REL-4_7

REL-4_8

REL-4_9

REL-5_0

REL-5_1

REL-5_2

REL-5_3

REL-5_4

REL-5_5

REL-5_6

REL-5_7

REL-6_0

REL-6_1

REL-6_10

REL-6_11

REL-6_12

REL-6_13

REL-6_14

REL-6_15

REL-6_16

REL-6_17

REL-6_18

REL-6_19

REL-6_2

REL-6_20

REL-6_21

REL-6_3

REL-6_4

REL-6_5

REL-6_6

REL-6_7

REL-6_8

REL-6_9

REL-7_0

REL-7_1

REL-7_2

REL-7_3

REL-7_4

REL-7_5

REL-7_6

REL-7_7

REL-7_8

REL-8_0

REL-8_1

REL-8_10

REL-8_11

REL-8_12

REL-8_13

REL-8_14

REL-8_2

REL-8_3

REL-8_4

REL-8_5

REL-8_6

REL-8_7

REL-8_8

REL-8_9

REL-9_0

REL-9_1

REL-9_10

REL-9_11

REL-9_12

REL-9_13

REL-9_14

REL-9_2

REL-9_3

REL-9_4

REL-9_5

REL-9_6

REL-9_7

REL-9_8

REL-9_9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7818.json"