Vulnerability DatabaseCVE-2024-3116
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2024-3116
Published:April 04, 2024
Updated:October 10, 2026
pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data.
Affected Packages
pgadmin4 (PYTHON):
Affected version(s) >=4.20 <8.5
Fix Suggestion:
Update to version 8.5
Related Resources (11)
https://pypi.org/project/pgadmin4
https://nvd.nist.gov/vuln/detail/CVE-2024-3116
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2
https://gist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98
https://github.com/pgadmin-org/pgadmin4/issues/7326
https://github.com/advisories/GHSA-27jx-ffw8-xrqv
https://github.com/pgadmin-org/pgadmin4
https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3116.json
https://github.com/pgadmin-org/pgadmin4/commit/fbbbfe22dd468bcfef1e1f833ec32289a6e56a8b
https://www.vicarius.io/vsociety/posts/remote-code-execution-vulnerability-in-pgadmin-cve-2024-3116
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2/
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
LOW
Subsequent System Integrity
LOW
Subsequent System Availability
LOW
Exploit Maturity
POC
CVSS v3
Base Score:
7.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
Exploit Maturity
FUNCTIONAL
Weakness Type (CWE)
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-77
EPSS
Base Score:
65.57