Количество 5
Количество 5
CVE-2026-7819
Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage directory pointing outside it and induce pgAdmin to write to any path reachable by the pgAdmin process. Fix switches the access check to os.path.realpath for both source and destination, and adds an _open_upload_target helper that opens the target with O_NOFOLLOW (mode 0o600) to close the leaf-component TOCTOU between the access check and the open. File mode is hardened from 0o644 to 0o600. This issue affects pgAdmin 4: before 9.15.
CVE-2026-7819
Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manage ...
GHSA-hr4r-fwpv-c95j
pgAdmin 4 File Manager has symbolic-link path traversal
BDU:2026-09125
Уязвимость функции check_access_permission() инструмента управления базами данных pgAdmin 4, позволяющая нарушителю оказать воздействие на целостность и доступность защищаемой информации
ROS-20260729-73-0032
Уязвимость pgadmin4
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-7819 Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager. check_access_permission used os.path.abspath, which resolves '..' but does not resolve symbolic links, while the subsequent kernel write follows symlinks. An authenticated user could plant a symbolic link inside their own storage directory pointing outside it and induce pgAdmin to write to any path reachable by the pgAdmin process. Fix switches the access check to os.path.realpath for both source and destination, and adds an _open_upload_target helper that opens the target with O_NOFOLLOW (mode 0o600) to close the leaf-component TOCTOU between the access check and the open. File mode is hardened from 0o644 to 0o600. This issue affects pgAdmin 4: before 9.15. | CVSS3: 8.1 | 0% Низкий | 3 месяца назад |
| CVE-2026-7819 Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manage ... | CVSS3: 8.1 | 0% Низкий | 3 месяца назад |
| GHSA-hr4r-fwpv-c95j pgAdmin 4 File Manager has symbolic-link path traversal | CVSS3: 8.1 | 0% Низкий | 3 месяца назад |
 | BDU:2026-09125 Уязвимость функции check_access_permission() инструмента управления базами данных pgAdmin 4, позволяющая нарушителю оказать воздействие на целостность и доступность защищаемой информации | CVSS3: 8.1 | 0% Низкий | 3 месяца назад |
 | ROS-20260729-73-0032 Уязвимость pgadmin4 | CVSS3: 8.1 | 0% Низкий | 5 дней назад |
Уязвимостей на страницу