An authenticated user can exploit the pgAdmin 4 Backup tool to perform arbitrary file operations and redirect database connections, leading to potential system compromise.

The vulnerability exists in the backup tool's handling of the database parameter, which is incorrectly passed to the pg_dump utility. Any authenticated user with the tools_backup permission can inject command-line arguments to overwrite arbitrary files or perform connection string injection, which exposes database credentials.

The ability to write arbitrary files or redirect database traffic poses a severe threat to the integrity and confidentiality of the pgAdmin environment. An attacker could overwrite critical configuration files to gain elevated access or intercept sensitive database credentials, leading to full compromise of the database management system. With a CVSS score of 8.8, this vulnerability represents a high risk that requires immediate attention to prevent unauthorized access to backend infrastructure.

Immediate Action: Update pgAdmin 4 to version 9.18 or later, which resolves the issue by securely passing the database name via the PGDATABASE environment variable rather than the argument vector.

Proactive Monitoring: Review application logs for unusual backup job parameters, specifically those containing dashes or connection string syntax in the database field.

Compensating Controls: Restrict the tools_backup permission to only trusted administrative users until the software can be patched, and ensure the pgAdmin process runs with the minimum necessary operating system privileges.

Public Exploit Available: No

This vulnerability is high-severity and permits significant control over the host system through standard application features. Security teams must prioritize updating to version 9.18 immediately to eliminate the risk of argument injection and credential exposure. Given that the vulnerability is accessible to any authenticated user, failure to patch leaves the environment susceptible to internal threats and compromised user accounts.