CVE-2021-33204

CRITICAL 9.8CVE-2021-33204 · Published 19/05/2021 · updated 17/06/2026

In short

CVE-2021-33204 is a CRITICAL (CVSS 9.8) vulnerability affecting pg partman (pgxn).
Chance of exploitation in the next 30 days (EPSS): 2.2%, higher than 82.6% of all vulnerabilities.
Fix: update to 4.5.1 or later.

Package	Affected versions	Patched versions
pg partman pgxn	`< 4.5.1`	`4.5.1`

Description

In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions because an explicit search_path is not set.

References

pgpartman/pg_partman commit 0b6565a · Patch
pgpartman/pg_partman · Patch
security.netapp.com/advisory/ntap-20210625-0006 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free