---
id: CVE-2022-4223
aliases:
  - GHSA-3v6v-2x6p-32mc
  - PYSEC-2026-893
title: pgadmin4 vulnerable to Code Injection
summary: pgadmin4 vulnerable to Code Injection
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
vendor: pgadmin4
product: pgadmin4
ecosystem: pip
affected:
  - pgadmin4 < 6.17
patched:
  - pgadmin4 6.17
published: '2022-12-13'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-3v6v-2x6p-32mc'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-4223'
  - url: 'https://github.com/pgadmin-org/pgadmin4/issues/5593'
  - url: 'https://github.com/pgadmin-org/pgadmin4'
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5EYTPKHVFSDCETBJI7LBZE4EYHBPN2Q
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R5EYTPKHVFSDCETBJI7LBZE4EYHBPN2Q
tags:
  - osv
  - pip
  - exploit-available
epss: 0.80069
epssPercentile: 0.99596
ingestedAt: '2026-07-08T18:25:44.957Z'
exploits:
  nuclei:
    - CVE-2022-4223
  checkedAt: '2026-09-23T07:13:24.244Z'
exploitAvailable: true
---

## Overview

The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.

## Affected packages

- `pgadmin4 < 6.17`

## Remediation

Upgrade to a patched release:

- `pgadmin4 6.17`