The vulnerability arises from symlink following in PostgreSQL’s pg_basebackup and pg_rewind utilities when used in plain format. An origin superuser can create or modify arbitrary symlinks that point to sensitive host files such as /var/lib/postgres/.bashrc, allowing those files to be overwritten during the backup or rewind process. By replacing a shell initialization file, an attacker can inject malicious commands that execute whenever the associated user logs in, effectively hijacking an operating‑system account. This flaw is caused by symlink following (CWE‑59) and path‑traversal (CWE‑61).

Affected releases are PostgreSQL versions prior to 18.4, prior to 17.10, prior to 16.14, prior to 15.18, and prior to 14.23. The issue is specific to the PostgreSQL database server product and does not affect other vendors or products.

The CVSS base score of 8.8 denotes high severity. An EPSS score of 0.00049 (< 1%) indicates a very low but non‑zero probability of exploitation. However, the attack still requires an origin superuser to execute pg_basebackup or pg_rewind and to intervene between those commands and a subsequent server start, which limits the exploit window but does not eliminate risk. Because the vulnerability can modify files that are executed by the database user, it can lead to persistent compromise once the server is restarted. The vulnerability is not listed in the CISA KEV catalog, indicating that known exploits have not yet been observed, but the impact is serious if exploited.