Aller au contenu
en Se connecter
8.8 Élevée

CVE-2026-6475 Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite…

Description

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Produits et versions touchés

Produit Versions touchées Corrigé en
postgresql 18 18 → < 18.4 18.4
postgresql 17 17 → < 17.10 17.10
postgresql 16 16 → < 16.14 16.14
postgresql 15 15 → < 15.18 15.18
postgresql 14.23 premières → < 14.23 14.23

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de postgresql

Les 79 CVE de postgresql →
CVE-2026-6471 Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen… 7.2 Élevée CVE-2026-14671 Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating… 8.8 Élevée CVE-2026-6470 Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and… 4.3 Moyenne CVE-2026-6464 Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as… 8.1 Élevée
Suivre cette CVE