pg_partman is a PostgreSQL extension for managing partitioned tables. In versions prior to 5.5.0, the undo_partition() function reads the part_config.time_encoder parameter as unrestricted text and interpolates it directly into a dynamically executed SELECT statement without identifier quoting. This improper neutralization of special elements leads to an SQL injection vulnerability (CWE-89). A user with partman_user role access can supply SQL code instead of a function name, causing arbitrary SQL execution with the privileges of the caller. The vulnerability does not affect the default background-worker path, which limits automatic superuser privilege escalation, but still allows abuse of the caller's permissions. The vulnerability is addressed by an official fix in version 5.5.0.

Successful exploitation allows a user with partman_user role access to execute arbitrary SQL commands with the privileges of the caller invoking undo_partition(). This can lead to unauthorized disclosure, modification, or deletion of data, impacting confidentiality, integrity, and availability of the database. The vulnerability does not automatically escalate privileges to superuser but can be leveraged to abuse the permissions of the invoking role.

Upgrade pg_partman to version 5.5.0 or later, where this SQL injection vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory indicating the fix in version 5.5.0.