CVE-2026-7816High· 8.8▾ TwilightpgAdmin 4: OS command injection vulnerability in Import/Export query export
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
1.4%
Last analysed / modified upstream
OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.
User-supplied input was interpolated directly into a psql \copy metacommand template without sanitization. An authenticated user could inject ") TO PROGRAM 'cmd'" to break out of the \copy (...) context and achieve arbitrary command execution on the pgAdmin server, or ") TO '/path'" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable.
Fix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks.
This issue affects pgAdmin 4: before 9.15.
pgadmin4 < 9.15Upgrade to a patched release:
pgadmin4 9.15Connected by shared product, vendor, weakness, or advisory.
CVE-2026-7813Critical· 9.9pgAdmin 4 server mode has an authorization vulnerability affecting Server Groups, Servers, Shared Servers, Background Processes, and Debu…
CVE-2026-7817Medium· 6.5pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities
CVE-2026-7820Medium· 6.5pgAdmin 4: Improper restriction of excessive authentication attempts
CVE-2026-7819High· 8.1pgAdmin 4 File Manager has symbolic-link path traversal
CVE-2026-7815High· 8.8SQL injection vulnerability in pgAdmin 4 Maintenance Tool
CVE-2026-7814Medium· 4.8pgAdmin 4: Stored cross-site scripting (XSS) vulnerability in Browser Tree and Explain Visualizer modules