8.8
CVE-2026-6475
- EPSS 0.05%
- Veröffentlicht 14.05.2026 13:00:11
- Zuletzt bearbeitet 14.05.2026 16:21:23
- Quelle f86ef6dc-4d3a-42ad-8f28-e6d554
- CVE-Watchlists
- Unerledigt
PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellern/a
≫
Produkt
PostgreSQL
Default Statusunaffected
Version
18
Version <
18.4
Status
affected
Version
17
Version <
17.10
Status
affected
Version
16
Version <
16.14
Status
affected
Version
15
Version <
15.18
Status
affected
Version
0
Version <
14.23
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.05% | 0.142 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
CWE-61 UNIX Symbolic Link (Symlink) Following
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.