CVE-2022-26520: Path traversal in org.postgresql:postgresql
Summary
CVE-2022-26520: Path traversal in org.postgresql:postgresql. Affects org.postgresql:postgresql versions >= 42.1.0, < 42.3.3. Fixed in 42.3.3. How to fix ↓
Also tracked for
- postgresql-jdbc-driver · Bitnami
- libpgjava · Debian:11
The same CVE-2022-26520 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
org.postgresql:postgresql is a popular JDBC driver for connecting Java applications to PostgreSQL databases. It provides a set of classes and methods to establish and manage database connections, execute SQL statements, and retrieve results. This vulnerability affects versions prior to 42.3.3 of the driver.
Vulnerability Detail
The vulnerability in org.postgresql:postgresql (CVE-2022-26520) allows an attacker to perform path traversal attacks by exploiting the jdbc URL or properties. By manipulating the loggerFile and loggerLevel connection properties, an attacker can call java.util.logging.FileHandler to write to arbitrary files. This can lead to various malicious activities, such as creating executable files in sensitive locations, like a Tomcat web root. It's important to note that the vendor considers this a vulnerability for any application using the pgjdbc driver with untrusted connection properties.
How To Fix
Latest published version: 42.7.14 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
42.3.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is advised to carefully validate and sanitize the jdbc URL and properties before using them to establish a connection with the PostgreSQL database. Implement strict input validation and enforce a whitelist of allowed characters and paths. Additionally, consider using a security framework or library that provides protection against path traversal attacks.
Conclusion
The vulnerability (CVE-2022-26520) in org.postgresql:postgresql allows for path traversal attacks, potentially leading to unauthorized access, data leakage, or remote code execution. It is crucial to upgrade to version 42.3.3 or later to mitigate this risk. Additionally, implementing input validation and using security frameworks can provide further protection. For further assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.postgresql:postgresql →
FAQ
org.postgresql:postgresql is a JDBC driver for connecting Java applications to PostgreSQL databases. It provides the necessary functionality to establish and manage database connections, execute SQL statements, and retrieve results.
This vulnerability allows an attacker to perform path traversal attacks, potentially leading to unauthorized access, data leakage, or remote code execution. It can be particularly dangerous if the attacker gains write access to sensitive files or directories.
To fix this vulnerability, upgrade to version 42.3.3 or later of org.postgresql:postgresql. Update the dependency in your project's pom.xml file or use the appropriate package manager to install the updated version.
No, only versions prior to 42.3.3 are affected by this vulnerability. It is recommended to upgrade to the latest secure version to mitigate the risk.
Yes, as a workaround, carefully validate and sanitize the jdbc URL and properties before using them to establish a connection. Implement strict input validation and enforce a whitelist of allowed characters and paths. Consider using a security framework or library that provides protection against path traversal attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.postgresql:postgresql.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
