https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:31:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-370773 EUVD-2026-370773 https://cve.radiocsirt.org/vuln/euvd-2026-370773 https://cve.radiocsirt.org/vuln/fkie_cve-2026-86864 <p>pgAdmin 4&#39;s Backup tool appended the client-supplied &#39;database&#39; field from the /backup/job/&lt;sid&gt;/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_long, which permutes arguments, a value beginning with a dash was interpreted as an option rather than as a database name. A value such as --file=/absolute/path therefore overrode the storage-confined --file that pgAdmin had constructed earlier, causing pg_dump to write its output anywhere the pgAdmin process could write, outside the user&#39;s File Manager storage directory. This yields arbitrary file creation and overwrite as the operating-system account running pgAdmin, which can destroy pgAdmin&#39;s own configuration database and, depending on the target chosen, be escalated further.</p> <p>The same field additionally permitted connection-string injection. libpq expands a database name containing an equals sign into a full connection string, and keywords embedded there override the --host and --port that pgAdmin passes, so a value such as &#39;host=attacker.example port=5432 dbname=x&#39; redirected pg_dump to a server of the attacker&#39;s choosing. Because pgAdmin exports the decrypted stored database password in the PGPASSWORD environment variable before executing the utility, the redirected connection carries that credential to the attacker-nominated endpoint. Both behaviours are reachable by any authenticated user holding the tools_backup permis…</p> <p>pgAdmin 4&#39;s Backup tool appended the client-supplied &#39;database&#39; field from the /backup/job/&lt;sid&gt;/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_long, which permutes arguments, a value beginning with a dash was interpreted as an option rather than as a database name. A value such as --file=/absolute/path therefore overrode the storage-confined --file that pgAdmin had constructed earlier, causing pg_dump to write its output anywhere the pgAdmin process could write, outside the user&#39;s File Manager storage directory. This yields arbitrary file creation and overwrite as the operating-system account running pgAdmin, which can destroy pgAdmin&#39;s own configuration database and, depending on the target chosen, be escalated further.</p> <p>The same field additionally permitted connection-string injection. libpq expands a database name containing an equals sign into a full connection string, and keywords embedded there override the --host and --port that pgAdmin passes, so a value such as &#39;host=attacker.example port=5432 dbname=x&#39; redirected pg_dump to a server of the attacker&#39;s choosing. Because pgAdmin exports the decrypted stored database password in the PGPASSWORD environment variable before executing the utility, the redirected connection carries that credential to the attacker-nominated endpoint. Both behaviours are reachable by any authenticated user holding the tools_backup permis…</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-86864 https://cve.radiocsirt.org/vuln/ghsa-xrr3-3pj6-6gw9 <p>pgAdmin 4&#39;s Backup tool appended the client-supplied &#39;database&#39; field from the /backup/job/&lt;sid&gt;/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_long, which permutes arguments, a value beginning with a dash was interpreted as an option rather than as a database name. A value such as --file=/absolute/path therefore overrode the storage-confined --file that pgAdmin had constructed earlier, causing pg_dump to write its output anywhere the pgAdmin process could write, outside the user&#39;s File Manager storage directory. This yields arbitrary file creation and overwrite as the operating-system account running pgAdmin, which can destroy pgAdmin&#39;s own configuration database and, depending on the target chosen, be escalated further.</p> <p>The same field additionally permitted connection-string injection. libpq expands a database name containing an equals sign into a full connection string, and keywords embedded there override the --host and --port that pgAdmin passes, so a value such as &#39;host=attacker.example port=5432 dbname=x&#39; redirected pg_dump to a server of the attacker&#39;s choosing. Because pgAdmin exports the decrypted stored database password in the PGPASSWORD environment variable before executing the utility, the redirected connection carries that credential to the attacker-nominated endpoint. Both behaviours are reachable by any authenticated user holding the tools_backup permis…</p> <p>pgAdmin 4&#39;s Backup tool appended the client-supplied &#39;database&#39; field from the /backup/job/&lt;sid&gt;/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_long, which permutes arguments, a value beginning with a dash was interpreted as an option rather than as a database name. A value such as --file=/absolute/path therefore overrode the storage-confined --file that pgAdmin had constructed earlier, causing pg_dump to write its output anywhere the pgAdmin process could write, outside the user&#39;s File Manager storage directory. This yields arbitrary file creation and overwrite as the operating-system account running pgAdmin, which can destroy pgAdmin&#39;s own configuration database and, depending on the target chosen, be escalated further.</p> <p>The same field additionally permitted connection-string injection. libpq expands a database name containing an equals sign into a full connection string, and keywords embedded there override the --host and --port that pgAdmin passes, so a value such as &#39;host=attacker.example port=5432 dbname=x&#39; redirected pg_dump to a server of the attacker&#39;s choosing. Because pgAdmin exports the decrypted stored database password in the PGPASSWORD environment variable before executing the utility, the redirected connection carries that credential to the attacker-nominated endpoint. Both behaviours are reachable by any authenticated user holding the tools_backup permis…</p> https://cve.radiocsirt.org/vuln/ghsa-xrr3-3pj6-6gw9 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3446 <p>Ein Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um Dateien zu manipulieren, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um Dateien zu manipulieren, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3446