pgAdmin Remote Code Execution (RCE) vulnerability

CRITICAL 9.8CVE-2024-3116 · GHSA-27jx-ffw8-xrqv · PYSEC-2026-1767 · Published 04/04/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
pgadmin4 PyPI	`< 8.5`	`8.5`
pgadmin 4 pgadmin	`≤ 8.4`	No fix yet

Description

pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2024-3116 · ADVISORY
pgadmin-org/pgadmin4 · WEB
pgadmin-org/pgadmin4 commit fbbbfe2 · WEB
gist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98 · WEB
pgadmin-org/pgadmin4 · PACKAGE
lists.fedoraproject.org/archives/list/[email protected]/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2 · WEB
vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-pgadmin-cve-2024-3116 · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2 · Mailing List
pypi.org/project/pgadmin4 · PACKAGE
GitHub Advisory GHSA-27jx-ffw8-xrqv · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free