CVE-2024-2044

CVE-2024-2044 is a critical path-traversal vulnerability affecting pgAdmin versions up to 8.3, including various Fedora and pgAdmin 4 distributions. This flaw allows for remote code execution through session deserialization. On Windows servers, an unauthenticated attacker can exploit this to load and deserialize remote pickle objects, achieving code execution. On POSIX/Linux systems, an authenticated attacker can upload and deserialize pickle objects for the same outcome. The vulnerability carries a CVSS score of 9.9 (CRITICAL) due to its network-based attack vector, low complexity, and complete compromise of confidentiality, integrity, and availability. While not yet observed in active exploitation (no KEV entry), a Metasploit module exists, indicating readily available exploit code, though there is currently no significant community discussion or media coverage.