pgAdmin 4 Symbolic-Link Path Traversal Vulnerability Allowing Arbitrary File Write

A symbolic-link path traversal vulnerability has been identified in pgAdmin 4 File Manager versions prior to 9.15. The issue arises because the `check_access_permission` function uses `os.path.abspath`, which resolves directory traversal sequences but fails to resolve symbolic links. Consequently, an authenticated user could create a symbolic link in their storage directory that points outside of it, leading pgAdmin to write to any path accessible by the pgAdmin process.

Impact

Exploitation of this vulnerability allows for arbitrary file writes to any location reachable by the pgAdmin process, potentially leading to unauthorized data modification or overwriting critical files.

Remediation

This vulnerability has been fixed in pgAdmin 4 version 9.15. Users should upgrade to this version.