Description
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Remediation
References
Related Vulnerabilities
Jboss EAP Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2011-2487)
Ruby on Rails Uncontrolled Resource Consumption Vulnerability (CVE-2021-22880)
MySQL Uncontrolled Resource Consumption Vulnerability (CVE-2025-50092)
WordPress Plugin WP Simple Booking Calendar Cross-Site Request Forgery (1.3)