Threats tagged 'ghsa-hw9h-5hmm-63g6'

pgAdmin 4 in server mode improperly resolves file paths for server password files, SSL certificates, keys, CRLs, and SSH tunnel identity files relative to the user's storage directory. This flaw allows path traversal to access or use another user's sensitive files. Additionally, crafted connection parameter names can bypass validation, potentially injecting unauthorized parameters. The issue affects versions before 9.19 and has a high severity CVSS score of 8.4.