Member-only story
pgAdmin 4 Just Patched 15 Security Flaws — One Could Execute Commands on the Server
The pgAdmin 4 v9.19 release fixes a dangerous Import/Export vulnerability alongside authentication, credential, and file-access issues that PostgreSQL administrators should not overlook.
A database administration tool should help developers manage databases — not become a way to execute unexpected commands on the machine hosting it.
That is why the pgAdmin 4 v9.19 release deserves attention. It includes 136 bug fixes and improvements, but its most important changes are security-related: 15 vulnerabilities have been addressed, including an OS command-injection flaw in the Import/Export Data tool.
The issue is particularly interesting because it demonstrates how a seemingly ordinary database operation can cross a security boundary. A crafted identifier could bypass a protection mechanism around PostgreSQL’s \copy command and expose a TO PROGRAM clause capable of executing commands on the pgAdmin host.
The release also addresses weaknesses involving authentication, stored credentials, file paths, SSH, Kerberos, and user sessions.
