GitHub Advisoryadvisory · Packagist

GHSA-86gh-c8r8-xwhq phpPgAdmin contains a remote command execution vulnerability

HIGH Published 2026-01-21 Modified 2026-02-02 Official page ↗
Aliases
CVE-2021-47853
Ecosystem
Packagist
Packages
phppgadmin/phppgadmin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2026-02-02

Affected packages

• Packagist phppgadmin/phppgadmin: <= 7.13.0 (no fix yet)

Description

phpPgAdmin 7.13.0 contains a remote command execution vulnerability that allows authenticated attackers to execute arbitrary system commands through SQL query manipulation. Attackers can create a custom table, upload a malicious .txt file, and use the COPY FROM PROGRAM command to execute operating system commands with the application's privileges.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References