Remote Code Execution

pgadmin4 is vulnerable to Remote Code Execution. The vulnerability is caused by a missing validation in the pgAdmin server HTTP API - validate_binary_path that is used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. This can result in an authenticated attacker running arbitrary commands on the server by using commands as filenames used to validate path using the API. This eventually results in injecting the command in the path validator and execute the command on the pgAdmin server.