IT Security 1 month ago

pgAdmin 4 save_file Symlink TOCTOU Vulnerability (CVE‑2026‑86861)

pgAdmin 4’s save_file endpoint suffers a symlink race that could let attackers write arbitrary files. A patch adds O_NOFOLLOW protection and tighter permissions. pgAdmin 4’s save_file endpoint suffers a symlink race that could let attackers write arbitrary files. A patch adds O_NOFOLLOW protection and tighter permissions.

FacebookXReddit

IT Security

Executive summary

A TOCTOU (time‑of‑check‑to‑time‑of‑use) race condition in pgAdmin 4’s File Manager save_file endpoint allows a malicious actor to replace the final path component with a symbolic link and cause the server to write outside the intended storage directory. The write occurs with the privileges of the operating‑system account running pgAdmin, potentially leading to arbitrary file creation or overwriting.

What is affected

  • Product: pgAdmin 4
  • Component: File Manager save_file endpoint
  • Affected versions: All pgAdmin 4 releases that contain the containment check introduced before version 9.18 (exact version range not confirmed).

Severity and evidence

  • CVSS score: Not provided in the source.
  • Evidence: The vulnerability is a classic TOCTOU symlink race. The reporter performed ~63,000 racing requests without achieving a successful write against a released version, indicating that exploitation is non‑trivial but theoretically possible.

Business or operational impact

If exploited, an attacker could create or overwrite arbitrary files on the pgAdmin host, potentially:

  • Escalating privileges by modifying configuration or executable files.
  • Corrupting or exfiltrating data stored by pgAdmin.
  • Disrupting database administration workflows.

Detection considerations

  • Monitor filesystem audit logs for unexpected writes outside a user’s storage directory.
  • Look for error messages indicating symbolic‑link refusal (e.g., ELOOP or EINVAL).
  • Track creation of new symbolic links in directories used by pgAdmin’s File Manager.

Recommended defensive actions

  1. Apply the upstream fix that routes save_file writes through the O_NOFOLLOW‑protected helper.
  2. Restrict filesystem access to the pgAdmin host, especially for shared or network‑mounted storage used by the File Manager.
  3. Enforce least‑privilege for the OS account running pgAdmin; avoid running it as root.
  4. Enable audit logging for file creation and modification events in the pgAdmin storage path.
  5. Validate and monitor any external mounts for unexpected symbolic links.

Workarounds or mitigations, if supported

  • Disable or limit the File Manager feature if it is not required.
  • Use read‑only mounts for directories that should never be written to by pgAdmin.
  • Periodically scan the storage directory for symbolic links and remove any that are not expected.

Patch or remediation status

The fix has been committed to the pgAdmin codebase, adding O_NOFOLLOW protection and setting new files to mode 0600. The source does not specify a released version number or date for the patch, so the exact remediation status in production deployments is not confirmed.

References

  • NVD entry for CVE‑2026‑86861: https://nvd.nist.gov/vuln/detail/CVE-2026-86861

Publication date and last checked date

  • Publication date: 2026-09-18
  • Last checked: 2026-09-18

← Back to IT Security