CVE-2024-2044
highpriority · track · 38EPSS 0.795 · 100 %ileexploit · weaponizedDEEURUUSEPSS · scored 2026-10-27
pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them, and gain code execution.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.1–9.9
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (2)
Public proof-of-concept and weaponised exploit code.
- exploit/multi/http/pgadmin_session_deserializationpgAdmin Session Deserialization RCEweaponized · metasploit
- hanzzly/CVE-2024-2044hanzzly/CVE-2024-2044PoC · poc_in_github
affected products (12)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-0576pgAdmin: Schwachstelle ermöglicht CodeausführungDeutsch2024-03-06csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in pgAdmin ausnutzen, um beliebigen Programmcode auszuführen.
- GHSA-rj98-crf4-g69wpgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user2024-03-07ghsa · osvUS
pgAdmin prior to version 8.4 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them and gain code execution.
- PYSEC-2026-453pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user2026-06-29vendor · osvUS
pgAdmin prior to version 8.4 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code execution. If the server is running on POSIX/Linux, an authenticated attacker can upload pickle objects, deserialize them and gain code execution.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (11)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-2044/cnnvd
- https://github.com/pgadmin-org/pgadmin4/issues/7258cnnvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/cnnvd
- https://vigilance.fr/vulnerability/pgAdmin-code-execution-via-session-deserialization-44107cnnvd
- https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/cnnvd
- https://github.com/pgadmin-org/pgadmin4/issues/7258enisa_euvd
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LUYN2JXKKHFSVTASH344TBRGWDH64XQV/enisa_euvd
- https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan