CVE-2026-116330

PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 are vulnerable to a psql command injection via the undocumented restore.sql file. The issue stems from the inclusion of untrusted data in the pg_dump tar-format, where a predictable restriction key allows a compromised origin serve...

Vulnerability in client (CVE-2026-116330)

PostgreSQL pgdump tar restore.sql fails to block psql command injection Untrusted data inclusion in PostgreSQL pgdump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in...