This vulnerability in pgAdmin 4 affects the Import/Export query export functionality where user-supplied input is directly inserted into a psql \copy metacommand without proper sanitization. An authenticated user can inject payloads such as ") TO PROGRAM 'cmd'" to break out of the intended context and execute arbitrary OS commands on the server, or ") TO '/path'" to write arbitrary files. Additional parameters like format, on_error, and log_verbosity are also vulnerable due to raw interpolation. The flaw is addressed in pgAdmin 4 version 9.15 by implementing a parentheses-balance parser modeled after psql's tokenizer, allow-listing acceptable values for certain fields, rejecting null bytes in queries, and enforcing stricter type and gating validations.

Successful exploitation allows an authenticated user to execute arbitrary operating system commands or write arbitrary files on the pgAdmin server, leading to full compromise of confidentiality, integrity, and availability of the affected system. This can result in unauthorized data access, data manipulation, or denial of service.

A fix is available in pgAdmin 4 version 9.15 which addresses this vulnerability by sanitizing inputs and enforcing strict parsing and validation. Users should upgrade to version 9.15 or later to remediate this issue. Patch status is not explicitly confirmed in the provided data, but the vendor has released a fixed version. No additional mitigations are specified.