https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:49:22 +0000 https://cve.radiocsirt.org/vuln/cve-2026-86861 <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>pgAdmin 4&#39;s File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-7819 had previously hardened the separate file upload path by opening its target with O_NOFOLLOW, so that the kernel refuses to follow a symbolic link at the final path component, but save_file was left on an unprotected open(). A symbolic link already present when the check ran was rejected by the check itself; the remaining exposure was a link substituted at the final path component in the interval between the check and the write, at which point the write followed the link and landed outside the user&#39;s storage directory, creating or overwriting an arbitrary file as the operating-system account running pgAdmin.</p> <p>Exploitation requires the ability to create or replace a symbolic link inside the requesting user&#39;s storage directory. pgAdmin exposes no interface that creates symbolic links, so this requires filesystem access to the pgAdmin host or to a shared or network-mounted storage backend, together with winning the timing window. The reporter did not achieve a write against a released version, having attempted approximately 63,000 racing requests without success; the reported defect is the uncovered write path rather than a demonstrated sandbox escape.</p> <p>The fix routes save_file&#39;s write through the same O_NOFOLLOW-protected helper already use…</p> <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>pgAdmin 4&#39;s File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-7819 had previously hardened the separate file upload path by opening its target with O_NOFOLLOW, so that the kernel refuses to follow a symbolic link at the final path component, but save_file was left on an unprotected open(). A symbolic link already present when the check ran was rejected by the check itself; the remaining exposure was a link substituted at the final path component in the interval between the check and the write, at which point the write followed the link and landed outside the user&#39;s storage directory, creating or overwriting an arbitrary file as the operating-system account running pgAdmin.</p> <p>Exploitation requires the ability to create or replace a symbolic link inside the requesting user&#39;s storage directory. pgAdmin exposes no interface that creates symbolic links, so this requires filesystem access to the pgAdmin host or to a shared or network-mounted storage backend, together with winning the timing window. The reporter did not achieve a write against a released version, having attempted approximately 63,000 racing requests without success; the reported defect is the uncovered write path rather than a demonstrated sandbox escape.</p> <p>The fix routes save_file&#39;s write through the same O_NOFOLLOW-protected helper already use…</p> https://cve.radiocsirt.org/vuln/cve-2026-86861