CVE-2023-0241 pgAdmin 4 vulnerable to directory traversal
Attackers can exploit directory traversal in pgAdmin 4 to modify other users' settings or alter the database.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-0241?
CVE-2023-0241 is a medium-severity path traversal vulnerability in pgadmin, published on 27 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database.
Weakness: CWE-22
Which versions are affected by CVE-2023-0241?
3 open source packages ship an affected version, including pgadmin4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pgadmin4 PyPI | All versions | 6.19 |
pgadmin4 PyPI | All versions | 6.19 |
pgadmin4 PyPI | All versions | 6.19 |
Linux distribution packages (10)
pgadmin4 SUSE:Enterprise Storage 7.1 | All versions | 4.30-150300.3.9.1 |
pgadmin4 SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS | All versions | 4.30-150300.3.9.1 |
pgadmin4 SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 4.30-150300.3.9.1 |
pgadmin4 SUSE:Linux Enterprise Module for Server Applications 15 SP4 | All versions | 4.30-150300.3.9.1 |
pgadmin4 SUSE:Linux Enterprise Real Time 15 SP3 | All versions | 4.30-150300.3.9.1 |
pgadmin4 SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 4.30-150300.3.9.1 |
pgadmin4 SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 4.30-150300.3.9.1 |
pgadmin4 SUSE:Manager Proxy 4.2 | All versions | 4.30-150300.3.9.1 |
pgadmin4 SUSE:Manager Server 4.2 | All versions | 4.30-150300.3.9.1 |
pgadmin4 openSUSE:Leap 15.4 | All versions | 4.30-150300.3.9.1 |
Products include Pgadmin Pgadmin 4.
How do I fix CVE-2023-0241?
Upgrade pgadmin4 to 6.19 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-0241 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0241 exists.
Other vulnerabilities in pgadmin
- CVE-2025-2945 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment
- CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4
- CVE-2026-12046 Deserialization in pgAdmin 4
- CVE-2026-17351 SQL injection in pgAdmin 4
- CVE-2026-17566 Command injection in pgAdmin 4
Sources
Also known as GHSA-9crj-hpxh-f6qg, PYSEC-2026-1771, SUSE-SU-2023:1877-1.