A race condition exists in pgAdmin 4 where the server mode validator checks a file path for compliance but opens the target file without enforcing the containment twice. An attacker who can create a symlink, hardlink, or FIFO inside the user’s storage directory after the check but before the open can redirect file operations to arbitrary locations on the host system. This flaw allows the owner of the pgAdmin OS account to write to or overwrite files outside the intended storage area, read sensitive host files, or inject data into PostgreSQL tables via pg_dump, pg_dumpall, pg_restore, or psql, potentially compromising confidentiality, integrity, and availability of the underlying database and server.

The vulnerability affects all instances of pgAdmin 4 whose version is earlier than 9.19. The affected product is pgadmin.org:pgAdmin 4, which is widely used for PostgreSQL administration in both desktop and server deployments.

The CVSS score of 7.3 indicates a high severity error. Exploitation requires the attacker to have write access to the per‑user storage directory, which is typically owned by the pgAdmin OS account; therefore the attack surface is limited to environments using shared or network‑mounted filesystems where other users can modify the storage backend. While EPSS information is not available, the lack of listing in the CISA KEV catalog suggests that documented exploitation is currently unknown. Consequently, the risk is considered high in severity but moderate to low in likelihood for most deployments.