Every CVE Search/ Get API key

CVE-2019-9193

** DISPUTED ** In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows...

7.2 HighPublic exploitDisputed

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

91.7%Up 45.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.2

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.

Record
CVE-2019-9193
CVSS 3.0
7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness
CWE-78
Updated
2026-11-02
CVE List No score

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.

Record
CVE-2019-9193
Updated
2026-11-02
EUVDEUVD-2019-18570 No score

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.

Record
EUVD-2019-18570
Updated
2026-11-03
GitHub AdvisoriesGHSA-j83j-hfqj-cf5p 7.2

** DISPUTED ** In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows...

** DISPUTED ** In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.

Record
GHSA-j83j-hfqj-cf5p
CVSS 3.0
7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
OSVBELL-CVE-2019-9193 7.2

CVE-2019-9193 does not affect BellSoft software

Record
BELL-CVE-2019-9193
CVSS 3.0
7.2 HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPostgreSQL 9.3 - COPY FROM PROGRAM Command Execution (Metasploit)2019-05-08
MetasploitPostgreSQL COPY FROM PROGRAM Command Execution2019-03-20
NucleiPostgreSQL 9.3-12.3 Authenticated Remote Code Execution
PoC in GitHubCyberCTF/vulhub-postgres-cve-2019-91932026-10-08
PoC in GitHubCybersRMUTL/CVE-2019-9193-Postgresql-RCE2026-01-21
PoC in GitHubb4keSn4ke/CVE-2019-91932022-03-29
PoC in GitHubcorsisechero/CVE-2019-9193byVulHub2025-04-02
PoC in GitHubgeniuszly/CVE-2019-91932024-10-06
PoC in GitHubjhnhnck/CVE-2019-91932025-03-20
PoC in GitHubnetw0rk7/CVE-2019-9193-Home-Lab2025-11-17
PoC in GitHubpaulotrindadec/CVE-2019-91932023-02-01
PoC in GitHubwkjung0624/cve-2019-91932020-02-12

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-9193 is a high vulnerability (CVSS 7.2) in Postgresql, published April 1, 2019. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 91.7%, the 99th percentile.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open