GHSA-hr4r-fwpv-c95j

Source

https://github.com/advisories/GHSA-hr4r-fwpv-c95j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-hr4r-fwpv-c95j/GHSA-hr4r-fwpv-c95j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hr4r-fwpv-c95j

Aliases

Downstream

CGA (4)

Published

2026-05-11T18:31:44Z

Modified

2026-09-10T03:51:06Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

pgAdmin 4 File Manager has symbolic-link path traversal

Details

Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.

check_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage directory pointing outside it and induce pgAdmin to write to any path reachable by the pgAdmin process.

Fix switches the access check to os.path.realpath for both source and destination, and adds an _open_upload_target helper that opens the target with O_NOFOLLOW (mode 0o600) to close the leaf-component TOCTOU between the access check and the open. File mode is hardened from 0o644 to 0o600.

This issue affects pgAdmin 4: before 9.15.

Database specific

{
    "cwe_ids":  [
        "CWE-61"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-18T14:56:48Z",
    "nvd_published_at":  "2026-05-11T16:17:39Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / pgadmin4

Package

Name: pgadmin4; View open source insights on deps.dev
Purl: pkg:pypi/pgadmin4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.15

Affected versions

4.*

4.20

4.22

4.23

4.24

4.25

4.26

4.27

4.28

4.29

4.30

5.*

5.0

5.1

5.2

5.3

5.4

5.5

5.6

5.7

6.*

6.2

6.3

6.4

6.5

6.6

6.7

6.8

6.9

6.10

6.11

6.12

6.13

6.14

6.15

6.16

6.17

6.18

6.19

6.20

6.21

7.*

7.0

7.1

7.2

7.3

7.4

7.5

7.6

7.7

7.8

8.*

8.0

8.1

8.2

8.3

8.4

8.5

8.6

8.7

8.8

8.9

8.10

8.11

8.12

8.13

8.14

9.*

9.0

9.1

9.2

9.3

9.4

9.5

9.6

9.7

9.8

9.9

9.10

9.11

9.12

9.13

9.14

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-hr4r-fwpv-c95j/GHSA-hr4r-fwpv-c95j.json"