CVE-2026-116249

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "..//.pgpass", set through the server dialog, t...

CVE-2026-116249 pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "..//.pgpass", set through the server dialog, t...

EUVD-2026-114390

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "..//.pgpass", set through the server dialog, t...

CVE-2026-116249

In pgAdmin 4 versions before 9.19 , a vulnerability exists where the application fails to properly sanitize file paths relative to the user's storage directory. Because get_complete_file_path() only strips leading slashes, an attacker can use path traversal sequences (e.g., ..//.pgpass) via the s...

CVE-2026-116249: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file…

In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage directory, but getcompletefilepath only stripped leading slashes before joining the two. A path such as "../ /.pgpass", set through the server dialog,...