Description
pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pgadmin.org | pgAdmin 4 | < 8.5 | 8.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pgadmin4 | 8.5-1.1 | openSUSE-SU-2024:13843-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
pgAdmin Binary Path API RCE
exploit/windows/http/pgadmin_binary_path_api
GitHub 1 repository
-
TechieNeurons/CVE-2024-3116_RCE_in_pgadmin_8.4 ★ 13 · Apr 7, 2024
Making a lab and testing the CVE-2024-3116, a Remote Code Execution in pgadmin <=8.4
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pgadmin4 | < 8.5 | 8.5 | GHSA-27jx-ffw8-xrqv |
Advisories 2
- openSUSE-SU-2024:13843-1 pgadmin4-8.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0798 pgAdmin: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Apr 14, 2024