CVE-2024-3116

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
pgadmin.org	pgAdmin 4	< 8.5
postgresql	pgadmin_4	< 8.5

References

https://gist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98Exploit, Third Party Advisory
https://github.com/pgadmin-org/pgadmin4/issues/7326Exploit, Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2/Mailing List
https://gist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98Exploit, Third Party Advisory
https://github.com/pgadmin-org/pgadmin4/issues/7326Exploit, Issue Tracking
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2/Mailing List
https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-pgadmin-cve-2024-3116Exploit, Third Party Advisory

Timeline

Published: Apr 4, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-311604.8The parameter used in the certain page of ASUS Download Master is not properly filtered for user input. A remote attacker with administrativ CVE-2024-311617.2The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exp CVE-2024-311627.2The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote attacker with adminis CVE-2024-311637.2ASUS Download Master has a buffer overflow vulnerability. An unauthenticated remote attacker with administrative privileges can exploit this CVE-2024-311647.5Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vu CVE-2024-311657.5Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vu CVE-2024-311667.5Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with p CVE-2024-311677.5Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vu CVE-2024-311687.5Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with p CVE-2024-311697.5Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with p CVE-2024-31174.7A vulnerability classified as critical was found in YouDianCMS up to 9.5.12. This vulnerability affects unknown code of the file App\Lib\Act CVE-2024-311707.5Out-of-bounds Read vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vulnerability is associated with p