Vulnerability Report

CVE-2026-7816

RCE

Title: OS Command Injection in Import/Export Query export

RCE

Proof Of Concept

No public PoC currently indexed for CVE-2026-7816.

CWE Category NVD-CWE-noinfo

Published Date May 11, 2026

Modified Date May 26, 2026

Exploit Status Not Found

Score 8.7 CVSS v4.0

Exploit Probability (EPSS)

1.44%

Vulnerability Summary

CVE-2026-7816: OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export. User-supplied input was interpolated directly into a psql \copy metacommand template without sanitization. An authenticated user could inject ") TO PROGRAM 'cmd'" to break out of the \copy (...) context and achieve arbitrary command execution on the pgAdmin server, or ") TO '/path'" for arbitrary file write. Additional fields (format, on_error, log_verbosity) were also raw-interpolated and exploitable. Fix adds a parens-balance parser modeled on psql's strtokx tokenizer, allow-lists format/on_error/log_verbosity, rejects null bytes in the query, and tightens type and gating checks. This issue affects pgAdmin 4: before 9.15.

Impacted Vendors

pgadmin 1

Reference Links

https://github.com/pgadmin-org/pgadmin4/issues/9899

CVSS v4.0

Source Entity f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Severity HIGH

8.7

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

N/A

RAW VECTOR

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1