id: PYSEC-2026-1767
published: "2026-07-07T11:45:37.487467Z"
modified: "2026-07-07T17:25:00.544522Z"
aliases:
- CVE-2024-3116
- GHSA-27jx-ffw8-xrqv
summary: pgAdmin Remote Code Execution (RCE) vulnerability
details: pgAdmin <= 8.4 is affected by a  Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.
affected:
- package:
    name: pgadmin4
    ecosystem: PyPI
    purl: pkg:pypi/pgadmin4
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: "8.5"
  versions:
  - "4.20"
  - "4.22"
  - "4.23"
  - "4.24"
  - "4.25"
  - "4.26"
  - "4.27"
  - "4.28"
  - "4.29"
  - "4.30"
  - "5.0"
  - "5.1"
  - "5.2"
  - "5.3"
  - "5.4"
  - "5.5"
  - "5.6"
  - "5.7"
  - "6.10"
  - "6.11"
  - "6.12"
  - "6.13"
  - "6.14"
  - "6.15"
  - "6.16"
  - "6.17"
  - "6.18"
  - "6.19"
  - "6.2"
  - "6.20"
  - "6.21"
  - "6.3"
  - "6.4"
  - "6.5"
  - "6.6"
  - "6.7"
  - "6.8"
  - "6.9"
  - "7.0"
  - "7.1"
  - "7.2"
  - "7.3"
  - "7.4"
  - "7.5"
  - "7.6"
  - "7.7"
  - "7.8"
  - "8.0"
  - "8.1"
  - "8.2"
  - "8.3"
  - "8.4"
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2024-3116
- type: WEB
  url: https://github.com/pgadmin-org/pgadmin4/issues/7326
- type: WEB
  url: https://github.com/pgadmin-org/pgadmin4/commit/fbbbfe22dd468bcfef1e1f833ec32289a6e56a8b
- type: WEB
  url: https://gist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98
- type: PACKAGE
  url: https://github.com/pgadmin-org/pgadmin4
- type: WEB
  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2
- type: WEB
  url: https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-pgadmin-cve-2024-3116
- type: PACKAGE
  url: https://pypi.org/project/pgadmin4
- type: ADVISORY
  url: https://github.com/advisories/GHSA-27jx-ffw8-xrqv
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L