Summary
A path traversal vulnerability in pgAdmin 4 can cause server connection files, certificates, keys, and related identities to resolve outside the intended user's storage directory. An attacker who can control server definitions, connection parameters, or imported configuration may access another user's credentials or keys, create or append files with pgAdmin's privileges, or influence libpq connection behavior.
A path traversal vulnerability in pgAdmin 4 can cause server connection files, certificates, keys, and related identities to resolve outside the intended user's storage directory. An attacker who can control server definitions, connection parameters, or imported configuration may access another user's credentials or keys, create or append files with pgAdmin's privileges, or influence libpq connection behavior.
Affected context
The issue affects pgAdmin 4 server-mode deployments that resolve connection-related files from user-controlled server definitions, REST API requests, or imported servers.json data. Risk is increased where path values are joined to storage directories without canonicalization, symbolic-link containment checks, or strict validation of libpq connection parameter names. The affected file types include password files, certificates, private keys, CRLs, SSH tunnel identity files, and SSL key-log destinations.
The issue affects pgAdmin 4 server-mode deployments that resolve connection-related files from user-controlled server definitions, REST API requests, or imported servers.json data. Risk is increased where path values are joined to storage directories without canonicalization, symbolic-link containment checks, or strict validation of libpq connection parameter names. The affected file types include password files, certificates, private keys, CRLs, SSH tunnel identity files, and SSL key-log destinations.
Exploit preconditions
- Attack surface: pgAdmin server definitions, REST API inputs, connection dialogs, or servers.json imports
- Required access: Ability to create or modify a server definition or submit connection parameters accepted by pgAdmin
- Trigger point: Path resolution or connection construction when the configured server is used
- Why exploitation is possible: Relative traversal sequences and symbolic links can escape the intended storage boundary, while insufficient validation of parameter names can alter the generated libpq connection string
- Additional condition: Target files or directories must be readable, writable, or otherwise usable by the account running pgAdmin
- Attack surface: pgAdmin server definitions, REST API inputs, connection dialogs, or servers.json imports
- Required access: Ability to create or modify a server definition or submit connection parameters accepted by pgAdmin
- Trigger point: Path resolution or connection construction when the configured server is used
- Why exploitation is possible: Relative traversal sequences and symbolic links can escape the intended storage boundary, while insufficient validation of parameter names can alter the generated libpq connection string
- Additional condition: Target files or directories must be readable, writable, or otherwise usable by the account running pgAdmin
Why this happens
The primary flaw is an incomplete path confinement check mapped to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Removing only leading separators before joining a user-controlled value to a storage directory does not prevent parent-directory traversal or escapes through symbolic links.
The related CWE-73: External Control of File Name or Path applies because externally supplied server configuration determines which filesystem objects are opened or where libpq may create or append files. The connection-string builder also validated parameter values without restricting parameter names to an exact allowlist, allowing crafted names to influence the syntax and semantics of downstream connection parsing.
The primary flaw is an incomplete path confinement check mapped to CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Removing only leading separators before joining a user-controlled value to a storage directory does not prevent parent-directory traversal or escapes through symbolic links.
The related CWE-73: External Control of File Name or Path applies because externally supplied server configuration determines which filesystem objects are opened or where libpq may create or append files. The connection-string builder also validated parameter values without restricting parameter names to an exact allowlist, allowing crafted names to influence the syntax and semantics of downstream connection parsing.
Potential impact
- An attacker may read another user's saved database password, client certificate, private key, CRL, or SSH identity file.
- pgAdmin may connect using credentials or identities belonging to another user.
- The process may create or append an SSL key-log file outside the intended storage directory.
- Sensitive connection material may be disclosed or exposed to unauthorized users.
- Crafted connection parameters could alter libpq behavior or bypass intended connection checks.
- File access or connection misuse could support further compromise of databases or the host account.
- An attacker may read another user's saved database password, client certificate, private key, CRL, or SSH identity file.
- pgAdmin may connect using credentials or identities belonging to another user.
- The process may create or append an SSL key-log file outside the intended storage directory.
- Sensitive connection material may be disclosed or exposed to unauthorized users.
- Crafted connection parameters could alter libpq behavior or bypass intended connection checks.
- File access or connection misuse could support further compromise of databases or the host account.
General mitigation guidance
Mitigation generally focuses on enforcing storage-boundary guarantees and reducing trust in externally supplied connection configuration.
Common defensive patterns include:
- Canonicalizing paths with symbolic links resolved before verifying containment within the user's storage directory or an explicitly named shared storage directory.
- Rejecting traversal, escapes, unresolved paths, and storage destinations that fall outside approved roots.
- Applying the same confinement rules to special output paths such as SSL key-log files.
- Accepting only exact, explicitly supported libpq connection parameter names rather than trusting arbitrary names.
- Reporting rejected paths and parameters clearly instead of allowing downstream libraries to apply defaults.
- Limiting pgAdmin filesystem permissions and running it with the minimum account privileges required.
- Keeping credentials, private keys, and shared storage separated with appropriate ownership and access controls.
Mitigation generally focuses on enforcing storage-boundary guarantees and reducing trust in externally supplied connection configuration.
Common defensive patterns include:
- Canonicalizing paths with symbolic links resolved before verifying containment within the user's storage directory or an explicitly named shared storage directory.
- Rejecting traversal, escapes, unresolved paths, and storage destinations that fall outside approved roots.
- Applying the same confinement rules to special output paths such as SSL key-log files.
- Accepting only exact, explicitly supported libpq connection parameter names rather than trusting arbitrary names.
- Reporting rejected paths and parameters clearly instead of allowing downstream libraries to apply defaults.
- Limiting pgAdmin filesystem permissions and running it with the minimum account privileges required.
- Keeping credentials, private keys, and shared storage separated with appropriate ownership and access controls.
How teams detect issues like this
Detection can combine static analysis, review practices, runtime monitoring, and policy enforcement.
Useful approaches include:
- Searching for path joins that process user-controlled values without canonicalization and containment checks.
- Reviewing code for prefix stripping, naive string-based path validation, and missing symbolic-link handling.
- Identifying filesystem operations whose paths originate in server dialogs, REST requests, or imported configuration.
- Checking connection-string builders for unvalidated parameter names and delimiter-sensitive concatenation.
- Testing that rejected paths cannot escape approved roots and that unsupported keywords are refused.
- Monitoring pgAdmin for unusual reads of other users' storage, writes to unexpected locations, or unexpected libpq connection options.
- Using automated static analysis and dependency-aware code review tools to flag path traversal and injection patterns.
Detection can combine static analysis, review practices, runtime monitoring, and policy enforcement.
Useful approaches include:
- Searching for path joins that process user-controlled values without canonicalization and containment checks.
- Reviewing code for prefix stripping, naive string-based path validation, and missing symbolic-link handling.
- Identifying filesystem operations whose paths originate in server dialogs, REST requests, or imported configuration.
- Checking connection-string builders for unvalidated parameter names and delimiter-sensitive concatenation.
- Testing that rejected paths cannot escape approved roots and that unsupported keywords are refused.
- Monitoring pgAdmin for unusual reads of other users' storage, writes to unexpected locations, or unexpected libpq connection options.
- Using automated static analysis and dependency-aware code review tools to flag path traversal and injection patterns.
