This vulnerability in pgAdmin 4's FileBackedSessionManager allows unsafe deserialization of untrusted session-file contents. The session manager uses Python's standard serialization module to deserialize session files without first verifying their integrity via HMAC. An attacker with authenticated write access to the sessions directory can place a malicious serialized payload that leads to remote code execution under the pgAdmin process identity. The issue affects all versions before 9.15. The remediation involves prepending a 64-byte hex SHA-256 HMAC over the session data, computed with a SECRET_KEY, and verifying it before deserialization using a timing-safe comparison function.

Successful exploitation allows an authenticated user with write access to the sessions directory to achieve remote code execution at the operating system level with the privileges of the pgAdmin process. This can lead to full compromise of the pgAdmin environment and potentially the underlying system depending on the process privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves verifying a SHA-256 HMAC over session data before deserialization to prevent exploitation. Until an official patch or update is available, restrict write access to the sessions directory to trusted users only to mitigate risk.