CVE-2022-0959: pgAdmin 4 Path Traversal Vulnerability
Summary
CVE-2022-0959: pgAdmin 4 Path Traversal vulnerability. Affects pgadmin4 versions < 6.7. Fixed in 6.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin 4 is a popular open-source administration and development platform for PostgreSQL, designed to provide a user-friendly interface for database management. It allows users to execute SQL queries, manage database objects, and perform various administrative tasks. However, when running in server mode, pgAdmin 4 has a vulnerability that permits unauthorized file uploads outside designated storage directories, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from the failure of pgAdmin 4 to validate upload paths when files are uploaded through its user interface. This lack of validation allows an authenticated user to exploit path traversal techniques, enabling them to upload files to any location on the server where the pgAdmin process has write permissions. This could lead to unauthorized access to sensitive files or the execution of malicious scripts, compromising the integrity and security of the server.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.7
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==6.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the pgAdmin server to trusted users only and monitor file uploads closely. Additionally, consider implementing file upload restrictions based on file types and sizes to mitigate potential risks until the package can be updated.
Conclusion
The pgAdmin 4 Path Traversal vulnerability (CVE-2022-0959) poses a significant risk to users running the application in server mode. By failing to validate upload paths, it allows authenticated users to exploit the system. Users are strongly advised to update to version 6.7 or later to mitigate this risk and ensure the security of their database management environment.
See every vulnerability recorded for pgadmin4 →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
Any user running pgAdmin 4 in server mode with the ability to upload files is potentially affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update to the patched version, implement strict access controls and monitor file uploads to minimize the risk of exploitation.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
