CVE-2022-4223: pgadmin4 Code Injection Vulnerability
Summary
CVE-2022-4223: pgadmin4 vulnerable to Code Injection. Affects pgadmin4 versions < 6.17. Fixed in 6.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgadmin4 is an open-source administration and development platform for PostgreSQL databases. It provides a web-based interface for managing database objects, executing queries, and performing various administrative tasks. The vulnerability identified as CVE-2022-4223 affects versions of pgadmin4 prior to 6.17. This vulnerability allows an unauthenticated user to exploit a code injection flaw in the pgAdmin server's HTTP API. By manipulating the path parameter, an attacker can execute arbitrary code on the server, potentially leading to unauthorized access, data leakage, or further compromise of the system.
Vulnerability Detail
The pgAdmin server includes an HTTP API that is used to validate the path selected by a user for external PostgreSQL utilities like pg_dump and pg_restore. This API is responsible for determining the PostgreSQL version of the utility. However, versions of pgAdmin prior to 6.17 did not properly secure this API, allowing an unauthenticated user to call it with a path of their choosing. This could include a UNC path to a server controlled by the attacker on a Windows machine. As a result, the pgAdmin server would execute an executable file with the same name as the target path. This code injection vulnerability poses a significant risk as it enables arbitrary code execution within the context of the pgAdmin server, potentially leading to unauthorized actions and compromise of the underlying system.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.17
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==6.17"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to pgadmin4 version 6.17 or later.
Conclusion
The code injection vulnerability in pgadmin4 (CVE-2022-4223) poses a significant risk to systems running vulnerable versions of the software. It allows unauthenticated attackers to execute arbitrary code on the pgAdmin server, potentially leading to unauthorized access and compromise of the system. To mitigate this vulnerability, it is crucial to upgrade pgadmin4 to version 6.17 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pgadmin4 →
FAQ
pgadmin4 is an open-source administration and development platform for PostgreSQL databases. It provides a web-based interface for managing database objects, executing queries, and performing various administrative tasks.
The vulnerability allows an unauthenticated attacker to execute arbitrary code on the pgAdmin server. This can lead to unauthorized access, data leakage, or further compromise of the system.
To mitigate this vulnerability, it is recommended to upgrade pgadmin4 to version 6.17 or later.
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to pgadmin4 version 6.17 or later.
You can find more information about this vulnerability in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-3v6v-2x6p-32mc/GHSA-3v6v-2x6p-32mc.json
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
