PT-2026-39628 · Pgadmin 4+1 · Pgadmin 4+1

Fernando Bortotti · Published 2026-05-11 · Updated 2026-05-26 · CVE-2026-7818

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.15

Description The FileBackedSessionManager in pgAdmin 4 performs unsafe deserialization of session-file contents using Python's standard object-serialization module before conducting an HMAC integrity check. This allows any file placed in the sessions directory to be deserialized unconditionally. An authenticated user with write access to the sessions directory, potentially through misconfiguration or a path-traversal flaw, could use a crafted serialized payload to achieve remote code execution at the operating-system level under the pgAdmin process identity.

Recommendations Update to version 9.15 or later.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-7818

GHSA-4RHG-H8F2-V4JM

Affected Products

Pgadmin

Pgadmin 4

References · 8

• https://github.com/pgadmin-org/pgadmin4/issues/9901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7818 · Security Note
• https://osv.dev/vulnerability/GHSA-4rhg-h8f2-v4jm · Vendor Advisory
• https://github.com/pgadmin-org/pgadmin4 · Note
• https://github.com/pgadmin-org/pgadmin4/commit/30a890337 · Note
• https://twitter.com/CVEnew/status/2053954467360354783 · Twitter Post
• https://t.me/cveNotify/164679 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053892594942235043 · Twitter Post