https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 03:17:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-371531 EUVD-2026-371531 https://cve.radiocsirt.org/vuln/euvd-2026-371531 https://cve.radiocsirt.org/vuln/fkie_cve-2026-86861 <p>pgAdmin 4&#39;s File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-7819 had previously hardened the separate file upload path by opening its target with O_NOFOLLOW, so that the kernel refuses to follow a symbolic link at the final path component, but save_file was left on an unprotected open(). A symbolic link already present when the check ran was rejected by the check itself; the remaining exposure was a link substituted at the final path component in the interval between the check and the write, at which point the write followed the link and landed outside the user&#39;s storage directory, creating or overwriting an arbitrary file as the operating-system account running pgAdmin.</p> <p>Exploitation requires the ability to create or replace a symbolic link inside the requesting user&#39;s storage directory. pgAdmin exposes no interface that creates symbolic links, so this requires filesystem access to the pgAdmin host or to a shared or network-mounted storage backend, together with winning the timing window. The reporter did not achieve a write against a released version, having attempted approximately 63,000 racing requests without success; the reported defect is the uncovered write path rather than a demonstrated sandbox escape.</p> <p>The fix routes save_file&#39;s write through the same O_NOFOLLOW-protected helper already use…</p> <p>pgAdmin 4&#39;s File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-7819 had previously hardened the separate file upload path by opening its target with O_NOFOLLOW, so that the kernel refuses to follow a symbolic link at the final path component, but save_file was left on an unprotected open(). A symbolic link already present when the check ran was rejected by the check itself; the remaining exposure was a link substituted at the final path component in the interval between the check and the write, at which point the write followed the link and landed outside the user&#39;s storage directory, creating or overwriting an arbitrary file as the operating-system account running pgAdmin.</p> <p>Exploitation requires the ability to create or replace a symbolic link inside the requesting user&#39;s storage directory. pgAdmin exposes no interface that creates symbolic links, so this requires filesystem access to the pgAdmin host or to a shared or network-mounted storage backend, together with winning the timing window. The reporter did not achieve a write against a released version, having attempted approximately 63,000 racing requests without success; the reported defect is the uncovered write path rather than a demonstrated sandbox escape.</p> <p>The fix routes save_file&#39;s write through the same O_NOFOLLOW-protected helper already use…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-86861 https://cve.radiocsirt.org/vuln/ghsa-2wg3-5wmg-5872 <p>pgAdmin 4&#39;s File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-7819 had previously hardened the separate file upload path by opening its target with O_NOFOLLOW, so that the kernel refuses to follow a symbolic link at the final path component, but save_file was left on an unprotected open(). A symbolic link already present when the check ran was rejected by the check itself; the remaining exposure was a link substituted at the final path component in the interval between the check and the write, at which point the write followed the link and landed outside the user&#39;s storage directory, creating or overwriting an arbitrary file as the operating-system account running pgAdmin.</p> <p>Exploitation requires the ability to create or replace a symbolic link inside the requesting user&#39;s storage directory. pgAdmin exposes no interface that creates symbolic links, so this requires filesystem access to the pgAdmin host or to a shared or network-mounted storage backend, together with winning the timing window. The reporter did not achieve a write against a released version, having attempted approximately 63,000 racing requests without success; the reported defect is the uncovered write path rather than a demonstrated sandbox escape.</p> <p>The fix routes save_file&#39;s write through the same O_NOFOLLOW-protected helper already use…</p> <p>pgAdmin 4&#39;s File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-7819 had previously hardened the separate file upload path by opening its target with O_NOFOLLOW, so that the kernel refuses to follow a symbolic link at the final path component, but save_file was left on an unprotected open(). A symbolic link already present when the check ran was rejected by the check itself; the remaining exposure was a link substituted at the final path component in the interval between the check and the write, at which point the write followed the link and landed outside the user&#39;s storage directory, creating or overwriting an arbitrary file as the operating-system account running pgAdmin.</p> <p>Exploitation requires the ability to create or replace a symbolic link inside the requesting user&#39;s storage directory. pgAdmin exposes no interface that creates symbolic links, so this requires filesystem access to the pgAdmin host or to a shared or network-mounted storage backend, together with winning the timing window. The reporter did not achieve a write against a released version, having attempted approximately 63,000 racing requests without success; the reported defect is the uncovered write path rather than a demonstrated sandbox escape.</p> <p>The fix routes save_file&#39;s write through the same O_NOFOLLOW-protected helper already use…</p> https://cve.radiocsirt.org/vuln/ghsa-2wg3-5wmg-5872 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3446 <p>Ein Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um Dateien zu manipulieren, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um Dateien zu manipulieren, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3446