{"id":"CVE-2024-3116","aliases":["GHSA-27jx-ffw8-xrqv","PYSEC-2026-1767"],"title":"pgAdmin Remote Code Execution (RCE) vulnerability","summary":"pgAdmin Remote Code Execution (RCE) vulnerability","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","vendor":"pgadmin4","product":"pgadmin4","ecosystem":"pip","affected":["pgadmin4 < 8.5"],"patched":["pgadmin4 8.5"],"published":"2024-04-04","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-27jx-ffw8-xrqv","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3116"},{"url":"https://github.com/pgadmin-org/pgadmin4/issues/7326"},{"url":"https://github.com/pgadmin-org/pgadmin4/commit/fbbbfe22dd468bcfef1e1f833ec32289a6e56a8b"},{"url":"https://gist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98"},{"url":"https://github.com/pgadmin-org/pgadmin4"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2"},{"url":"https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-pgadmin-cve-2024-3116"}],"tags":["osv","pip","exploit-available"],"epss":0.65569,"epssPercentile":0.99255,"ingestedAt":"2026-07-08T18:25:44.171Z","exploits":{"github":1,"githubRepos":["https://github.com/TechieNeurons/CVE-2024-3116_RCE_in_pgadmin_8.4"],"metasploit":["exploit/windows/http/pgadmin_binary_path_api"],"checkedAt":"2026-09-21T15:26:27.992Z"},"exploitAvailable":true,"slug":"CVE-2024-3116","body":"## Overview\n\npgAdmin <= 8.4 is affected by a  Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.\n\n## Affected packages\n\n- `pgadmin4 < 8.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pgadmin4 8.5`","depth":"midnight","depthScore":66,"depthScoreParts":{"impact":40.7,"likelihood":13.1,"exploitation":12,"ransomware":0},"changes":[{"seq":4710,"id":"CVE-2024-3116","ts":1788887201918,"field":"exploit_available","old":"false","new":"true"},{"seq":3593,"id":"CVE-2024-3116","ts":1788886317720,"field":"exploit_available","old":"true","new":"false"},{"seq":2447,"id":"CVE-2024-3116","ts":1788882986383,"field":"exploit_available","old":"false","new":"true"},{"seq":1476,"id":"CVE-2024-3116","ts":1788882399759,"field":"exploit_available","old":"true","new":"false"},{"seq":590,"id":"CVE-2024-3116","ts":1788881836577,"field":"exploit_available","old":"false","new":"true"}]}