The vulnerability arises from symlink following in PostgreSQL’s pg_basebackup and pg_rewind utilities when used in plain format. An origin superuser can create or modify arbitrary symlinks that point to sensitive host files such as /var/lib/postgres/.bashrc, allowing those files to be overwritten during the backup or rewind process. By replacing a shell initialization file, an attacker can inject malicious commands that execute whenever the associated user logs in, effectively hijacking an operating‑system account. This flaw is a classic path‑traversal weakness (CWE‑61).

Affected releases are PostgreSQL versions prior to 18.4, prior to 17.10, prior to 16.14, prior to 15.18, and prior to 14.23. The issue is specific to the PostgreSQL database server product and does not affect other vendors or products.

The CVSS base score of 8.8 denotes high severity. No EPSS score is available, so the precise likelihood of exploitation cannot be quantified; however, the attack requires an origin superuser to execute pg_basebackup or pg_rewind and must intervene between those commands and a subsequent server start, which limits the attack window but does not eliminate risk. Because the vulnerability can modify files that are executed by the database user, it can lead to persistent compromise once the server is restarted. The vulnerability is not listed in the CISA KEV catalog, indicating that known exploits have not yet been observed, but the impact is serious if exploited.