75 matches found
CVE-2026-116314
Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination,...
postgresql: postgresql: Arbitrary code execution via crafted archive in pg_restore
A flaw was found in PostgreSQL. An attacker can achieve arbitrary code execution as the operating system user running the pgrestore database restoration utility by providing a specially crafted archive file. Due to improper input validation, processing this malicious archive causes commands to...
CVE-2026-116314
A flaw was found in PostgreSQL. An attacker can achieve arbitrary code execution as the operating system user running the pgrestore database restoration utility by providing a specially crafted archive file. Due to improper input validation, processing this malicious archive causes commands to...
ALPINE-CVE-2026-116314
Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination,...
CVE-2026-116314
Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination,...
DEBIAN-CVE-2026-116314
Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination,...
CVE-2026-116314
Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination,...
CVE-2026-116314
PostgreSQL pg_restore is vulnerable to arbitrary code execution due to improper input validation of non-plain archive providers. A crafted archive can trigger code execution as the operating system user running the utility. While crafted data may also cause arbitrary SQL to execute at the restore...
CVE-2026-116314 PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation
Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination,...
EUVD-2026-124494
Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination,...
CVE-2026-116314
Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination,...
CVE-2026-116314: n/a PostgreSQL: Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the…
Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination,...
Vulnerability in client (CVE-2026-116314)
PostgreSQL pgrestore executes arbitrary code due to missing non-plain archive validation Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted...
CVE-2026-116243: pgadmin.org pgAdmin 4: pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences
pgAdmin 4 runs pgdump, pgrestore, pgdumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGEDIR, not under a SHAREDSTORAGE directory, which ordinary users can upload files to. A...
TencentOS Server 3: postgresql:12 (TSSA-2026:1216)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1216 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...
postgresql: PostgreSQL code execution in restore operation
A flaw was found in PostgreSQL. This vulnerability allows a malicious superuser on a PostgreSQL server to inject arbitrary code into dump files created by pgdump, pgdumpall, and pgrestore, causing arbitrary code execution on the client machine when these dump files are restored by psql due to...
SUSE CVE-2026-86862
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...
EUVD-2026-81694
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...
CVE-2026-86862 pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...
CVE-2026-86862
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...