CVE-2023-0241
pgAdmin 4 vulnerable to directory traversal
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
- Record
CVE-2023-0241- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
- Record
CVE-2023-0241- Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2023-0964
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
- Record
EUVD-2023-0964- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-9crj-hpxh-f6qg
pgAdmin 4 vulnerable to directory traversal
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
- Record
GHSA-9crj-hpxh-f6qg- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-9crj-hpxh-f6qg
pgAdmin 4 vulnerable to directory traversal
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
- Record
GHSA-9crj-hpxh-f6qg- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVPYSEC-2026-1771
pgAdmin 4 vulnerable to directory traversal
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
- Record
PYSEC-2026-1771- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV No score
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
- Record
CVE-2023-0241- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13667-1 No score
pgadmin4-8.2-1.1 on GA media
These are all security issues fixed in the pgadmin4-8.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13667-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:1877-1 No score
Security update for pgadmin4
This update for pgadmin4 fixes the following issues:
- CVE-2023-0241: Fixed a directory traversal vulnerability (bsc#1207464).
- Record
SUSE-SU-2023:1877-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pgadmin4PyPI |
through 6.18 | 6.19 |
pgadmin4PyPI |
before 6.19, plus listed versions 4.204.224.234.244.25 Show 30 moreShow less4.264.274.284.294.305.05.15.25.35.45.55.65.76.106.116.126.136.146.156.166.176.186.26.36.46.56.66.76.86.9 |
6.19 |
pgadmin4SUSE:Linux Enterprise Module for Server Applications 15 SP4 |
before 4.30-150300.3.9.1 | 4.30-150300.3.9.1 |
pgadmin4SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS |
before 4.30-150300.3.9.1 | 4.30-150300.3.9.1 |
pgadmin4SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 4.30-150300.3.9.1 | 4.30-150300.3.9.1 |
pgadmin4SUSE:Linux Enterprise Real Time 15 SP3 |
before 4.30-150300.3.9.1 | 4.30-150300.3.9.1 |
pgadmin4SUSE:Linux Enterprise Server 15 SP3-LTSS |
before 4.30-150300.3.9.1 | 4.30-150300.3.9.1 |
pgadmin4SUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 4.30-150300.3.9.1 | 4.30-150300.3.9.1 |
pgadmin4SUSE:Manager Proxy 4.2 |
before 4.30-150300.3.9.1 | 4.30-150300.3.9.1 |
pgadmin4SUSE:Manager Server 4.2 |
before 4.30-150300.3.9.1 | 4.30-150300.3.9.1 |
pgadmin4SUSE:Enterprise Storage 7.1 |
before 4.30-150300.3.9.1 | 4.30-150300.3.9.1 |
pgadmin4openSUSE:Leap 15.4 |
before 4.30-150300.3.9.1 | 4.30-150300.3.9.1 |
pgadmin4openSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 8.2-1.1 | 8.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-0241 is a medium vulnerability (CVSS 6.5) in Open Source Pgadmin, published March 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.83%, the 95th percentile. Fixed in pgadmin4 6.19.
References
github.com/pgadmin-org/pgadmin4/issues/5734
jvn.jp/en/jp/JVN01398015
nvd.nist.gov/vuln/detail/CVE-2023-0241