CVE-2023-5002
Pgadmin4: remote code execution by an authenticated user
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Pgadmin4: remote code execution by an authenticated user
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
- Record
CVE-2023-5002- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2023-2508
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
- Record
EUVD-2023-2508- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ghp8-52vx-77j4
pgAdmin failed to properly control the server code
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.7 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
- Record
GHSA-ghp8-52vx-77j4- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
- Record
CVE-2023-5002- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV
Pgadmin4: remote code execution by an authenticated user
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
- Record
CVE-2023-5002- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVGHSA-ghp8-52vx-77j4
pgAdmin failed to properly control the server code
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.7 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
- Record
GHSA-ghp8-52vx-77j4- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVPYSEC-2026-1774
pgAdmin failed to properly control the server code
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.7 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
- Record
PYSEC-2026-1774- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13379-1 No score
pgadmin4-7.8-1.1 on GA media
These are all security issues fixed in the pgadmin4-7.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13379-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pgadmin4PyPI |
before 7.7 | 7.7 |
pgadmin4PyPI |
before 7.7, plus listed versions 4.204.224.234.244.25 Show 40 moreShow less4.264.274.284.294.305.05.15.25.35.45.55.65.76.106.116.126.136.146.156.166.176.186.196.26.206.216.36.46.56.66.76.86.97.07.17.27.37.47.57.6 |
7.7 |
pgadmin4openSUSE:Tumbleweed |
before 7.8-1.1 | 7.8-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5002 is a medium vulnerability (CVSS 6.0) in Pgadmin, published September 22, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.78%, the 78th percentile. Fixed in pgadmin4 7.7.
References
bugzilla.redhat.com/show_bug.cgi?id=2239164
github.com/pgadmin-org/pgadmin4/issues/6763
lists.fedoraproject.org/archives/list/[email protected]/message/2S24D3S2GVNGTDNE6SF2OQSOPU3H72UW
nvd.nist.gov/vuln/detail/CVE-2023-5002