CVE-2019-9193
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group…
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 91.7% · top 0.2% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.
Weakness
Affected products
n/a
- affected n/a
References (8)
- https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/ (opens in a new tab)x_transferred
- https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5 (opens in a new tab)x_transferred
- https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/ (opens in a new tab)x_transferred
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/ (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20190502-0003/ (opens in a new tab)x_transferred
- http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html (opens in a new tab)x_transferred
- http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html (opens in a new tab)x_transferred
- http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2019-9193)Record last updated .