MIME-Version: 1.0
From: Ashesh Vashi <ashesh.vashi@enterprisedb.com>
Date: Mon, 11 May 2026 19:54:23 +0530
Message-ID: 
 <CAG7mmoznpjU8g8i84VK5hjSKhUN_79bY7+koBNF9f4H=Qn20Yg@mail.gmail.com>
Subject: pgAdmin 4 v9.15 Released
To: pgadmin-support <pgadmin-support@postgresql.org>
Content-Type: multipart/alternative; boundary="0000000000008652dd06518b810d"
Archived-At: 
 <https://www.postgresql.org/message-id/CAG7mmoznpjU8g8i84VK5hjSKhUN_79bY7%2BkoBNF9f4H%3DQn20Yg%40mail.gmail.com>
Precedence: bulk

--0000000000008652dd06518b810d
Content-Type: text/plain; charset="UTF-8"

The pgAdmin Development Team is pleased to announce pgAdmin 4 version 9.15.

This release of pgAdmin 4 includes 19 bug fixes and new features. For more
details please see the release notes at:

https://www.pgadmin.org/docs/pgadmin4/9.15/release_notes_9_15.html

pgAdmin is the leading Open Source graphical management tool for
PostgreSQL. For more information, please see:

https://www.pgadmin.org/

Notable changes in this release include:

*Features:*

   - Allow the Docker container image to run as a non-default user via the
   PUID and PGID environment variables.


*Bugs/Housekeeping:*

   - Fix cross-user data access and shared-server privilege escalation in
   server mode (CVE-2026-7813).
   - Tighten Shared Server feature parity, owner-only field handling, and
   write guards as a follow-up to the data-isolation hardening.
   - Fix stored cross-site scripting (XSS) via crafted PostgreSQL object
   names rendered in the Browser Tree and Explain Visualizer (CVE-2026-7814).
   - Fix SQL injection in the Maintenance tool option values
   (CVE-2026-7815).
   - Fix OS command injection in Import/Export query export (CVE-2026-7816).
   - Fix local-file inclusion and server-side request forgery in the LLM
   API configuration endpoints (CVE-2026-7817).
   - Fix unsafe deserialization in the session manager that could lead to
   remote code execution (CVE-2026-7818). This change also encrypts session
   files at rest using Fernet, restricts session-file and DATA_DIR permissions
   to 0o600, switches the session-digest default from SHA-1 to SHA-256, and
   drops several non-roundtrippable live objects from the session.
   - Fix symlink-based path traversal in the file manager (CVE-2026-7819).
   - Fix account-lockout bypass on Flask-Security's default /login view so
   the locked field is honored on every authentication path (CVE-2026-7820).
   - Use absolute paths for a2enmod and a2enconf in the Debian setup script
   so it works when /usr/sbin is not on PATH.
   - Bump Python and JavaScript runtime/development dependencies, and
   upgrade ESLint to v10.
   - Update the Czech, Italian, Russian, Spanish, and Swedish translations.

*Deprecations:*

   - The BigAnimal cloud deployment integration is deprecated and will be
   removed in the next version of pgAdmin 4.

Builds for Windows and macOS are available now, along with a Python Wheel,
Docker Container, RPM, DEB Package, and source code tarball from:

https://www.pgadmin.org/download/

---

Ashesh Vashi
pgAdmin Project

--0000000000008652dd06518b810d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><p>The pgAdmin Development Team is pleased to announce pgA=
dmin 4 version 9.15.</p><p>This release of pgAdmin 4 includes 19 bug fixes =
and new features. For more details please see the release notes at:</p><p><=
a href=3D"https://www.pgadmin.org/docs/pgadmin4/9.15/release_notes_9_15.htm=
l" target=3D"_blank">https://www.pgadmin.org/docs/pgadmin4/9.15/release_not=
es_9_15.html</a></p><p>pgAdmin is the leading Open Source graphical managem=
ent tool for PostgreSQL. For more information, please see:</p><p><a href=3D=
"https://www.pgadmin.org/" target=3D"_blank">https://www.pgadmin.org/</a></=
p><p>Notable changes in this release include:</p><p><b>Features:</b></p><ul=
>
<li>Allow the Docker container image to run as a non-default user via the P=
UID and PGID environment variables.</li></ul><ul>
</ul><p><b>Bugs/Housekeeping:</b></p><ul>
<li>Fix cross-user data access and shared-server privilege escalation in se=
rver mode (CVE-2026-7813).</li>
<li>Tighten Shared Server feature parity, owner-only field handling, and wr=
ite guards as a follow-up to the data-isolation hardening.</li>
<li>Fix stored cross-site scripting (XSS) via crafted PostgreSQL object nam=
es rendered in the Browser Tree and Explain Visualizer (CVE-2026-7814).</li=
>
<li>Fix SQL injection in the Maintenance tool option values (CVE-2026-7815)=
.</li>
<li>Fix OS command injection in Import/Export query export (CVE-2026-7816).=
</li>
<li>Fix local-file inclusion and server-side request forgery in the LLM API=
 configuration endpoints (CVE-2026-7817).</li>
<li>Fix unsafe deserialization in the session manager that could lead to re=
mote code execution (CVE-2026-7818). This change also encrypts session file=
s at rest using Fernet, restricts session-file and DATA_DIR permissions to =
0o600, switches the session-digest default from SHA-1 to SHA-256, and drops=
 several non-roundtrippable live objects from the session.</li>
<li>Fix symlink-based path traversal in the file manager (CVE-2026-7819).</=
li>
<li>Fix account-lockout bypass on Flask-Security&#39;s default /login view =
so the locked field is honored on every authentication path (CVE-2026-7820)=
.</li>
<li>Use absolute paths for a2enmod and a2enconf in the Debian setup script =
so it works when /usr/sbin is not on PATH.</li>
<li>Bump Python and JavaScript runtime/development dependencies, and upgrad=
e ESLint to v10.</li>
<li>Update the Czech, Italian, Russian, Spanish, and Swedish translations.<=
/li></ul><p><b>Deprecations:</b></p><ul><li>The BigAnimal cloud deployment =
integration is deprecated and will be removed in the next version of pgAdmi=
n 4.</li></ul><p>Builds for Windows and macOS are available now, along with=
 a Python Wheel, Docker Container, RPM, DEB Package, and source code tarbal=
l from:</p><p><a href=3D"https://www.pgadmin.org/download/" target=3D"_blan=
k">https://www.pgadmin.org/download/</a></p><p>---</p><p>


</p><p>Ashesh Vashi<br>pgAdmin Project</p>
</div>

--0000000000008652dd06518b810d--