CVE-2024-2044: pgAdmin path traversal in session handling enables unsafe deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.9, very high EPSS, public exploit reference, and remote code execution with no authentication on Windows make this an urgent risk.

What it is

pgAdmin 8.3 and earlier is affected by a path-traversal flaw in the session handling code that deserializes user sessions. On Windows, an unauthenticated attacker can load and deserialize remote pickle objects, leading to code execution; on POSIX/Linux, an authenticated attacker can upload and deserialize pickle objects to achieve code execution.

Impact

An attacker can execute arbitrary code on the pgAdmin server, potentially compromising the host and any connected database credentials or sessions.

Attack surface

Reachable over the network through the session handling component. On Windows no authentication is required; on POSIX/Linux the attacker must be authenticated. No user interaction is indicated.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.79465, 99.583rd percentile) and a third-party advisory tagged Exploit is referenced, indicating public exploit information exists.

What to do

• Upgrade pgAdmin to a version later than 8.3 as soon as a fixed release is available.
• If immediate upgrade is not possible, restrict network access to the pgAdmin server to trusted users and networks.
• On Windows, treat the pgAdmin service as exposed and prioritize patching or isolating it.
• On POSIX/Linux, enforce least privilege and strong authentication for all pgAdmin accounts.
• Monitor pgAdmin session storage and logs for unexpected pickle files or path traversal patterns.

Detection

• Inspect pgAdmin session directories for unexpected or suspicious pickle files.
• Monitor web server and pgAdmin logs for path traversal sequences in session-related requests.
• Alert on unusual child processes or command execution spawned by the pgAdmin service.
• Track authentication events and session creation anomalies, especially on Windows where no auth is required.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.