This vulnerability in PostgreSQL concerns symlink following behavior in pg_basebackup (plain format) and pg_rewind. An origin superuser can exploit this to overwrite arbitrary local files on the server, potentially hijacking the OS account associated with PostgreSQL. The attack's practical impact depends on actions taken between executing these commands and restarting the PostgreSQL server, as the server implicitly trusts the origin superuser during startup due to features like shared_preload_libraries. Affected versions include all PostgreSQL releases before 18.4, 17.10, 16.14, 15.18, and 14.23. The CVSS v3.1 score is 8.8, indicating high severity. No vendor advisory or patch links are provided, and the remediation level is not specified.

Successful exploitation allows an origin superuser to overwrite local files on the PostgreSQL server host, such as the .bashrc file, which can lead to hijacking the operating system account. This can compromise system integrity and potentially allow privilege escalation or persistent access. The vulnerability's impact is contingent on the timing of server restart and any administrative actions taken between backup/rewind commands and server startup.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid taking actions that involve moving files or snapshots between pg_basebackup/pg_rewind operations and server restarts. Monitoring PostgreSQL vendor communications for updates and applying patches promptly once released is recommended.