The flaw lies in pgAdmin 4’s server mode file resolution logic. The get_complete_file_path function only strips leading slashes before concatenating the supplied path with the user’s storage directory. A user can set paths such as "../.pgpass" for a server’s password file, SSL certificate, key, CRL, or SSH identity file. When such a relative path is processed, it resolves to another user's configuration file or even a file outside the storage area, allowing that file to be read or written by the pgAdmin process. In addition, the sslkeylogfile parameter is forwarded to libpq unchanged, so an attacker can place a path that causes libpq to create or append a file as the pgAdmin user. The make_conninfo function quotes parameter values but not their names, enabling crafted parameter names to inject additional keyword=value pairs and bypass expected validation. The combined effect is that a user who can configure or import server definitions can read another user’s secrets, create or alter files on the filesystem, and potentially elevate privileges or tamper with other users’ data.

The vulnerability impacts pgAdmin 4 versions prior to 9.19. The affected components include configuration handling via the server dialog, the REST API for server settings, and the servers.json import function. The vendor is pgadmin.org and the product is pgAdmin 4.

The CVSS score of 7.2 indicates a moderate to high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. A likely attack vector is remote; an authenticated or trusted user who can add or modify server entries can supply malicious paths. The exploitation requires no special kernel privileges, but it can lead to reading sensitive files or creating arbitrary files that may be used for further privilege escalation. The overall risk is significant for environments where multiple user accounts coexist in the same pgAdmin instance and share the storage directory.