---
id: CVE-2026-116250
title: >-
  pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard
  link or FIFO planted after the containment check
summary: >-
  In server mode pgAdmin 4 validates a path a user gives for a file in their
  storage directory with check_access_permission() and then opened it by name.
  Several places opened it with a plain open() or handed the path to a utility
  that ope…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-367
  - CWE-59
vendor: pgadmin.org
product: pgAdmin 4
affected:
  - pgadmin_4 < 9.19
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T19:55:18.713Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116250'
references:
  - url: 'https://github.com/pgadmin-org/pgadmin4/issues/10647'
  - url: >-
      https://github.com/pgadmin-org/pgadmin4/commit/99f5606e2ebc7c94c7acdbab877ce7de54bfc756
  - url: >-
      https://github.com/pgadmin-org/pgadmin4/commit/c4321b9968342716f34bc5f10de6cac3c0567e68
  - url: >-
      https://github.com/pgadmin-org/pgadmin4/commit/730d1e783c339ec696a1f77f2eee6f4b52cb6c37
tags:
  - cve.org
epss: 0.00096
epssPercentile: 0.00691
ingestedAt: '2026-11-05T16:24:31.430Z'
---

## Overview

In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by name. Several places opened it with a plain open() or handed the path to a utility that opened it later: the servers.json export and import and the import file listing, and the files given to pg_dump, pg_dumpall, pg_restore and psql by Backup, Restore and Import/Export Data. A symbolic link swapped in at the file or at any parent directory between the check and the open redirected the operation outside the storage directory, so a file could be written, overwritten or read, or loaded into a table, as the operating-system account running pgAdmin. A hard link to an outside file, which O_NOFOLLOW does not detect, and a FIFO, which could hang a request, had the same effect. CVE-2026-86861 fixed this for the File Manager's save_file; these were the remaining paths.

Exploitation requires creating such a link or FIFO inside the user's storage directory. pgAdmin offers no way to do so, and the per-user storage directories belong to the pgAdmin account, so this requires write access to the storage backend as a different operating-system user, for example a shared or network-mounted storage directory, and winning the race.

The fix opens each file by walking down from the storage directory one component at a time with O_NOFOLLOW, accepting only a regular file with one link, and passes the utilities the open descriptor (/dev/fd/N) on Linux. Error messages no longer include the server path.

This issue affects pgAdmin 4: before 9.19.

## Affected

- `pgadmin_4 < 9.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.