The pgAdmin server's HTTP API for validating paths to external PostgreSQL utilities such as pg_dump and pg_restore, which the server executes to determine the PostgreSQL version, failed to properly restrict access in versions prior to 6.17. An attacker who can reach the API without authentication and get a user to interact with the request can supply a path of their choosing, such as a UNC path to a server they control on Windows, causing an executable with a matching name in that location to run on the pgAdmin server.
The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Versions of pgAdmin prior to 6.17 failed to properly secure this API, which could allow an unauthenticated user to call it with a path of their choosing, such as a UNC path to a server they control on a Windows machine. This would cause an appropriately named executable in the target path to be executed by the pgAdmin server.
Disclosed on 13 Dec 2022. No public exploit code or confirmed exploitation is recorded.
6 fixes in pgadmin4 over 3 years. The latest fix listed for pgadmin4 is 7.7.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: pgadmin4.
Upgrade to 6.17
Still affected on this line by CVE-2024-2044 (fixed in 8.4, a newer line); CVE-2024-3116 (fixed in 8.5, a newer line); CVE-2024-9014 (fixed in 8.12, a newer line); CVE-2025-2945 (fixed in 9.2, a newer line).
pip install "pgadmin4>=6.17"The first fix for CVE-2022-4223.
| If you run | Upgrade to |
|---|---|
| All versions before 6.17 | 6.17 |
“Up to” means the second version is the fix and is not affected.