{"cve":"CVE-2026-7818","nvd":{"published":"2026-05-11T16:17:38.847","modified":"2026-10-26T18:10:00.173","status":"Analyzed","description":"Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.\n\nThe session manager performed unsafe deserialization of session-file contents (using Python's standard object-serialization module) before performing any HMAC integrity check. Any file dropped into the sessions directory was deserialized unconditionally. An authenticated user with write access to the sessions directory (whether by misconfiguration or in combination with another path-traversal flaw) could plant a crafted serialized payload to achieve operating-system level remote code execution under the pgAdmin process identity.\n\nFix prepends a 64-byte hex SHA-256 HMAC over the session body, computed with SECRET_KEY, and verifies it via hmac.compare_digest before any deserialization. The check is raised (rather than asserted) on empty SECRET_KEY so it is not stripped under -O.\n\nThis issue affects pgAdmin 4: before 9.15.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-502"],"references":["https://github.com/pgadmin-org/pgadmin4/issues/9901"],"products":["pgadmin:pgadmin_4"],"source":"nvd","synced_at":"2026-10-26T18:27:13.530666824+00:00"},"epss":{"cve":"CVE-2026-7818","score":0.00131,"percentile":0.02657,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-4rhg-h8f2-v4jm","url":"https://osv.dev/vulnerability/GHSA-4rhg-h8f2-v4jm","summary":"pgAdmin 4 has deserialization of untrusted data in its FileBackedSessionManager","modified":"2026-09-10T03:50:45.513075748Z","packages":[{"ecosystem":"PyPI","name":"pgadmin4","purl":"pkg:pypi/pgadmin4","ranges":["<9.15"],"fixed":["9.15"]}]},{"id":"PYSEC-2026-2865","url":"https://osv.dev/vulnerability/PYSEC-2026-2865","summary":"pgAdmin 4 has deserialization of untrusted data in its FileBackedSessionManager","modified":"2026-07-13T16:32:56.065562689Z","packages":[{"ecosystem":"PyPI","name":"pgadmin4","purl":"pkg:pypi/pgadmin4","ranges":["<9.15"],"fixed":["9.15"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}