PT-2026-6394 · Packagist · Phppgadmin/Phppgadmin

Published 2026-01-21 · Updated 2026-01-21

OSV

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

phpPgAdmin 7.13.0 contains a remote command execution vulnerability that allows authenticated attackers to execute arbitrary system commands through SQL query manipulation. Attackers can create a custom table, upload a malicious .txt file, and use the COPY FROM PROGRAM command to execute operating system commands with the application's privileges.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

GHSA-86GH-C8R8-XWHQ

Affected Products

Phppgadmin/Phppgadmin

References · 6

• https://osv.dev/vulnerability/GHSA-86gh-c8r8-xwhq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-47853 · Security Note
• https://github.com/phppgadmin/phppgadmin/releases · Note
• https://github.com/phppgadmin/phppgadmin · Note
• https://vulncheck.com/advisories/phppgadmin-copy-from-program-command-execution · Note
• https://exploit-db.com/exploits/49736 · Note