CVE-2026-7816

描述

OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a psql \copy metacommand template without sanitization. An authenticated user could inject ") TO PROGRAM 'cmd'" to break out of the \copy (...) context and achieve arbitrary command execution on the pgAdmin server, or ") TO '/path'" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable. Fix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks. This issue affects pgAdmin 4: before 9.15.

如何修補 CVE-2026-7816

要修補 CVE-2026-7816,請將受影響套件升級到下列已修補版本。

• —升級至 9.15 或更新版本
• —升級至 9.15 或更新版本

CVE-2026-7816 正在被利用嗎?

低 — EPSS 為 1.4%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 9.15
• from 0, < 9.15

CVSS 分數

參考連結(6)

• ADVISORYgithub.com/advisories/GHSA-j74f-g7vx-fh4x
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-7816
• PATCHgithub.com/pgadmin-org/pgadmin4
• PATCHpypi.org/project/pgadmin4
• WEBgithub.com/pgadmin-org/pgadmin4/commit/13badc62c