What’s Vulnerable › Vulnerabilities

CVE-2019-9193

• Severity: high (CVSS 7.2 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 91.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-04-01 · updated 2026-06-17
• Weakness: CWE-78

Description

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary operating system commands on Windows, Linux, and macOS. NOTE: Third parties claim/state this is not an issue because PostgreSQL functionality for ‘COPY TO/FROM PROGRAM’ is acting as intended. References state that in PostgreSQL, a superuser can execute commands as the server user without using the ‘COPY FROM PROGRAM’.

Affected products

• PostgreSQL: from 9.3 through 11.2

References

• http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html
• http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html
• https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/
• https://medium.com/greenwolf-security/authenticated-arbitrary-command-execution-on-postgresql-9-3-latest-cd18945914d5
• https://paquier.xyz/postgresql-2/postgres-9-3-feature-highlight-copy-tofrom-program/
• https://security.netapp.com/advisory/ntap-20190502-0003/
• https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/authenticated-arbitrary-command-execution-on-postgresql-9-3/
• http://packetstormsecurity.com/files/152757/PostgreSQL-COPY-FROM-PROGRAM-Command-Execution.html
• http://packetstormsecurity.com/files/166540/PostgreSQL-11.7-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/171722/PostgreSQL-9.6.1-Remote-Code-Execution.html
• https://blog.hagander.net/when-a-vulnerability-is-not-a-vulnerability-244/

Get alerted when CVE-2019-9193 or the next vulnerability affects your stack