https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 01 Nov 2026 12:58:43 +0000 https://db.gcve.eu/vuln/cve-2026-116249 <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>In server mode pgAdmin 4 resolves a server&#39;s password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user&#39;s storage directory, but get_complete_file_path() only stripped leading slashes before joining the two. A path such as &#34;../&lt;another user&gt;/.pgpass&#34;, set through the server dialog, the REST API or a servers.json import, therefore named another user&#39;s file, and connecting used that user&#39;s saved passwords, client certificate or SSH key. The sslkeylogfile connection parameter was passed to libpq unchanged, so a path outside storage let libpq create or append a file as the account running pgAdmin.</p> <p>make_conninfo() also quoted connection parameter values but not their names, so a crafted parameter name could smuggle additional keyword=value pairs past these checks.</p> <p>The fix requires the resolved path, with symbolic links followed, to stay inside the user&#39;s storage directory or the named shared storage directory, confines sslkeylogfile the same way, and accepts only exact libpq keywords as connection parameter names. A refused path or keyword is reported instead of letting libpq fall back to a default.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> <p><strong>Affected:</strong> pgadmin.org pgAdmin 4</p> <p>In server mode pgAdmin 4 resolves a server&#39;s password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user&#39;s storage directory, but get_complete_file_path() only stripped leading slashes before joining the two. A path such as &#34;../&lt;another user&gt;/.pgpass&#34;, set through the server dialog, the REST API or a servers.json import, therefore named another user&#39;s file, and connecting used that user&#39;s saved passwords, client certificate or SSH key. The sslkeylogfile connection parameter was passed to libpq unchanged, so a path outside storage let libpq create or append a file as the account running pgAdmin.</p> <p>make_conninfo() also quoted connection parameter values but not their names, so a crafted parameter name could smuggle additional keyword=value pairs past these checks.</p> <p>The fix requires the resolved path, with symbolic links followed, to stay inside the user&#39;s storage directory or the named shared storage directory, confines sslkeylogfile the same way, and accepts only exact libpq keywords as connection parameter names. A refused path or keyword is reported instead of letting libpq fall back to a default.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> https://db.gcve.eu/vuln/cve-2026-116249