The vulnerability in pgAdmin 4 arises from a TOCTOU race condition in the save_file endpoint of the File Manager. Initially, the requested file path is validated using Filemanager.check_access_permission(), which rejects symbolic links present at that time. However, the subsequent file write operation uses a plain open() call without O_NOFOLLOW protection, allowing an attacker to substitute a symbolic link at the final path component after the check but before the write. This can cause the write to follow the symbolic link and create or overwrite arbitrary files outside the intended storage directory. Exploitation requires the ability to create or replace symbolic links within the user's storage directory, which pgAdmin does not provide via its interface, so filesystem or shared storage access is necessary. The fix routes the write operation through the same O_NOFOLLOW-protected helper used by the upload path, ensuring kernel-enforced refusal of symbolic links at the final path component and setting file permissions to 0600. Intermediate directory component substitution is not addressed by this fix. This vulnerability affects all pgAdmin 4 versions from initial introduction of the containment check up to but not including version 9.18.

Successful exploitation could allow an attacker with the ability to create or replace symbolic links in the user's storage directory to overwrite arbitrary files on the pgAdmin host with the privileges of the operating system account running pgAdmin. This could lead to integrity violations of files and potentially limited denial of service. However, exploitation requires local or shared filesystem access and precise timing, making it difficult in practice. No confidentiality or availability impact is indicated. The CVSS v3.1 base score is 5.9 (medium severity), reflecting the complexity and limited scope of impact.

An official fix is available in pgAdmin 4 version 9.18 and later, which routes the save_file write operation through an O_NOFOLLOW-protected helper to prevent symbolic link following at the final path component. Users should upgrade to version 9.18 or later to remediate this vulnerability. No additional mitigation is required as the fix enforces kernel-level protections and sets restrictive file permissions. Exploitation requires filesystem access to create symbolic links, which pgAdmin does not expose, limiting risk in typical deployments.