A configuration flaw allows a user to set the path to database utilities such as pg_dump, pg_restore, pg_dumpall, and psql. In server mode, the application accepted a custom binary location that pointed into a shared storage directory that any authenticated user could write to. The flaw also failed to validate the path against shared storage, meaning an uploaded file could be executed by the operating‑system account running pgAdmin. This provides an attacker the ability to run arbitrary code with the privileges of the pgAdmin process, a serious compromise of confidentiality, integrity, and availability. The weakness corresponds to improper validation of executable paths (CWE-426 and CWE-427).

The issue affects pgAdmin 4 installations older than version 9.19 when deployed in server mode. Attackers must have write access to the shared storage directory used by the pgAdmin instance and the ability to change the binary path in the user preferences.

The CVSS score of 7.7 indicates a high severity vulnerability. The EPSS score is not available, so the current exploitation probability is unknown; however, the flaw is readily demonstrable and suitable for local attackers with access to the shared directory. The vulnerability is not listed in the CISA KEV catalog, but its impact and the ease of exploitation warrant immediate attention. The likely attack vector is that an attacker uploads a malicious executable to the shared storage directory, assigns that file as the utility binary path in pgAdmin preferences, and then triggers any utility that runs that binary. The operating‑system account running pgAdmin will execute the malicious code, potentially achieving full control of the server environment.