PT-2026-39626 · Pgadmin 4+1 · Pgadmin 4+1

Chung Kim + 1 · Published 2026-05-01 · Updated 2026-05-26 · CVE-2026-7816

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.15

Description An OS command injection issue exists in the Import/Export query export feature. User-supplied input is interpolated directly into a psql copy metacommand template without proper sanitization. An authenticated user can inject specific sequences, such as ") TO PROGRAM 'cmd'", to execute arbitrary commands on the pgAdmin server, or ") TO '/path'" to perform arbitrary file writes. Additionally, the format, on error, and log verbosity fields are raw-interpolated and exploitable.

Recommendations Update to version 9.15 or later.

Exploit

Fix

SQL injection

OS Command Injection

Weakness Enumeration

CWE-89

CWE-78

Related Identifiers

BDU:2026-09123

CVE-2026-7816

GHSA-J74F-G7VX-FH4X

Affected Products

Pgadmin

Pgadmin 4

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7816.json · Exploit
• https://github.com/pgadmin-org/pgadmin4/issues/9899 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7816 · Security Note
• https://osv.dev/vulnerability/CVE-2026-7816 · Vendor Advisory
• https://cve.org/CVERecord?idCVE-2026-7816 · Security Note
• https://bdu.fstec.ru/vul/2026-09123 · Security Note
• https://osv.dev/vulnerability/GHSA-j74f-g7vx-fh4x · Vendor Advisory
• https://github.com/pgadmin-org/pgadmin4 · Note
• https://github.com/pgadmin-org/pgadmin4/commit/13badc62c · Note
• https://t.me/cveNotify/164684 · Telegram Post
• https://twitter.com/CVEnew/status/2053954469360984205 · Twitter Post