CVE-2026-7816
Severity CVSS v4.0:
HIGH
Type:
CWE-89
SQL Injection
Publication date:
11/05/2026
Last modified:
13/05/2026
Description
OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.<br />
<br />
User-supplied input was interpolated directly into a psql \copy metacommand template without sanitization. An authenticated user could inject ") TO PROGRAM &#39;cmd&#39;" to break out of the \copy (...) context and achieve arbitrary command execution on the pgAdmin server, or ") TO &#39;/path&#39;" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable.<br />
<br />
Fix adds a parens-balance parser modeled on psql&#39;s strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks.<br />
<br />
This issue affects pgAdmin 4: before 9.15.
Impact
Base Score 4.0
8.70
Severity 4.0
HIGH
Base Score 3.x
8.80
Severity 3.x
HIGH