PT-2026-39625 · Pgadmin 4+2 · Pgadmin 4+2

J3Seer · Published 2026-05-11 · Updated 2026-05-26 · CVE-2026-7815

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.15

Description An SQL injection exists in the Maintenance Tool where four user-supplied JSON fields—buffer usage limit, vacuum parallel, vacuum index cleanup, and reindex tablespace—are concatenated directly into the rendered VACUUM, ANALYZE, or REINDEX command and passed to psql --command. An authenticated user with the tools maintenance permission can break out of the option syntax to execute arbitrary SQL on the connected PostgreSQL server. This can further lead to operating-system command execution on the database host by invoking the COPY ... TO PROGRAM command.

Recommendations Update to version 9.15 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-7815

GHSA-HP84-P2GQ-6FVR

Affected Products

Pgadmin

Postgresql

Pgadmin 4

References · 8

• https://github.com/pgadmin-org/pgadmin4/issues/9898 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hp84-p2gq-6fvr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7815 · Security Note
• https://github.com/pgadmin-org/pgadmin4/commit/cf53953d9 · Note
• https://github.com/pgadmin-org/pgadmin4 · Note
• https://twitter.com/VulmonFeeds/status/2053902834169524529 · Twitter Post
• https://twitter.com/CVEnew/status/2053954470308991333 · Twitter Post
• https://t.me/cveNotify/164683 · Telegram Post