CVE-2026-6475

🗓️ 14 May 2026 13:00:11Reported by PostgreSQLType

cve🔗 web.nvd.nist.gov👁 138 Views🌐 WEB

Symlink following in PostgreSQL base backup and rewind lets origin superuser overwrite unrelated files, risking hijack at startup.

Reporter	Title	Published	Views	Family All 388
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	16 Jun 202615:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.	5 Aug 202607:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a privilege escalation in PostgreSQL [CVE-2026-6475]	24 Aug 202622:26	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in IBM AIX and PowerVM VIOS	21 Aug 202616:38	–	ibm
FreeBSD	PostgreSQL -- Multiple vulnerabilities	14 May 202600:00	–	freebsd
GithubExploit	Exploit for UNIX Symbolic Link Following in Postgresql	12 Oct 202602:55	–	githubexploit
Tenable Nessus	AIX : Multiple Vulnerabilities (IJ59563)	21 Aug 202600:00	–	nessus
Tenable Nessus	AIX : Multiple Vulnerabilities (IJ59564)	21 Aug 202600:00	–	nessus
Tenable Nessus	AIX : Multiple Vulnerabilities (IJ59565)	21 Aug 202600:00	–	nessus
Tenable Nessus	AIX : Multiple Vulnerabilities (IJ59566)	21 Aug 202600:00	–	nessus

NVD

Node

postgresql postgresqlRange<14.23

postgresql postgresqlRange15.0–15.18

postgresql postgresqlRange16.0–16.14

postgresql postgresqlRange17.0–17.10

postgresql postgresqlRange18.0–18.4

[
  {
    "defaultStatus": "unaffected",
    "product": "PostgreSQL",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "18.4",
        "status": "affected",
        "version": "18",
        "versionType": "rpm"
      },
      {
        "lessThan": "17.10",
        "status": "affected",
        "version": "17",
        "versionType": "rpm"
      },
      {
        "lessThan": "16.14",
        "status": "affected",
        "version": "16",
        "versionType": "rpm"
      },
      {
        "lessThan": "15.18",
        "status": "affected",
        "version": "15",
        "versionType": "rpm"
      },
      {
        "lessThan": "14.23",
        "status": "affected",
        "version": "0",
        "versionType": "rpm"
      }
    ]
  }
]

Source	Link
postgresql	www.postgresql.org/support/security/CVE-2026-6475/

Parameter	Position	Path	Description	CWE
-D	request body	pg_basebackup	A remote attacker can provide a malicious BASE_BACKUP tar stream containing an absolute symlink. When a victim runs pg_basebackup against this source, the tool follows the symlink and overwrites arbitrary files on the local filesystem that the backup user has permissions to write.	CWE-59, CWE-22
-F p	request body	pg_basebackup	A remote attacker can provide a malicious BASE_BACKUP tar stream containing an absolute symlink. When a victim runs pg_basebackup against this source, the tool follows the symlink and overwrites arbitrary files on the local filesystem that the backup user has permissions to write.	CWE-59, CWE-22

17 Jun 2026 11:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.18.8

EPSS0.0041

SSVC

CWE-61