Unsafe Deserialization and Remote Code Execution in pgAdmin 4
Summary
CVE-2024-2044: pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user. Affects pgadmin4 versions < 8.4. Fixed in 8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin 4 is an open-source administration and management platform for PostgreSQL databases. It provides a web-based interface for users to interact with their PostgreSQL instances, perform administrative tasks, and manage database objects. The vulnerability in pgAdmin 4 allows an authenticated user to exploit unsafe deserialization, leading to remote code execution.
Vulnerability Detail
The vulnerability in pgAdmin 4 arises from its file-based session management approach. Session files are stored on disk as pickle objects. When a user makes a request, the session cookie 'pga4_session' is used to retrieve the corresponding file. The file's content is then deserialized, and its signature is verified. However, versions of pgAdmin prior to 8.4 concatenate the session folder path with the session ID using the 'os.path.join' function without setting a trusted base-path. This allows an attacker to escape the intended folder and potentially execute arbitrary code.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.4
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==8.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually set a trusted base-path for session file loading in their pgAdmin 4 installation. This can be done by modifying the relevant code segment responsible for loading session files and ensuring that the base-path is properly validated and restricted to the intended directory.
Conclusion
The vulnerability in pgAdmin 4 allows an authenticated user to exploit unsafe deserialization, potentially leading to remote code execution. It is crucial to upgrade to pgAdmin 4 version 8.4 or later to fix this vulnerability. Alternatively, users can apply a temporary workaround by manually setting a trusted base-path for session file loading. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pgadmin4 →
FAQ
pgAdmin 4 is an open-source administration and management platform for PostgreSQL databases. It provides a web-based interface for users to interact with their PostgreSQL instances, perform administrative tasks, and manage database objects.
This vulnerability allows an authenticated user to exploit unsafe deserialization in pgAdmin 4, potentially leading to remote code execution. An attacker could execute arbitrary code within the context of the pgAdmin 4 application, compromising the security and integrity of the system.
To fix this vulnerability, it is recommended to upgrade to pgAdmin 4 version 8.4 or later. This version includes a fix that properly sets a trusted base-path for session file loading, preventing unauthorized access and code execution.
As a temporary workaround, users can manually set a trusted base-path for session file loading in their pgAdmin 4 installation. This can be done by modifying the relevant code segment responsible for loading session files and ensuring that the base-path is properly validated and restricted to the intended directory.
At the time of this report, there are no known public exploits specifically targeting this vulnerability in pgAdmin 4. However, it is crucial to promptly apply the recommended fix or workaround to mitigate the risk of potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
