pgadmin.org · pgAdmin 4
pgAdmin 4 versions up to and including 8.4 contain a command injection flaw in the validate binary path API, which allows arbitrary code to be executed on the server hosting pgAdmin. An attacker who can reach the API over the network and holds low-privilege authenticated access can trigger the flaw without any user interaction, with the code running in the context of the pgAdmin server.
pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.
Public exploit code (Metasploit) was available 7 days before disclosure.
A fix was bypassed or incomplete once over 5 years. The latest fix listed for pgadmin4 is 9.2.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
This is a bypass of the fix for CVE-2026-17566.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: pgadmin4.
Upgrade to 8.12
Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2022-4223, CVE-2024-2044, +1).
Still affected on this line by CVE-2025-2945 (fixed in 9.2, a newer line).
pip install "pgadmin4>=8.12"First fixed in 8.5 for CVE-2024-3116.
| If you run | Upgrade to |
|---|---|
| All versions before 8.5 | 8.12first fix for this CVE: 8.5 |
“Up to” means the second version is the fix and is not affected.