psqlODBC log files are created with default permissions at a predictable path and follow symbolic links
Summary
| CVE | CVE-2026-120066 |
|---|---|
| State | PUBLISHED |
| Assigner | PostgreSQL |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-02 19:18:03 UTC |
| Updated | 2026-11-02 20:17:39 UTC |
| Description | On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected. |
Risk And Classification
Primary CVSS: v3.1 5.3 MEDIUM from f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Problem Types: CWE-59 | CWE-732 | CWE-732 CWE-732 Incorrect Permission Assignment for Critical Resource | CWE-59 CWE-59 Improper Link Resolution Before File Access ('Link Following')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | Secondary | 5.3 | MEDIUM | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N |
| 3.1 | CNA | CVSS | 5.3 | MEDIUM | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | PostgreSQL | PsqlODBC | affected 18.00.0006 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-wj7r-... | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: Upgrade to psqlODBC 18.00.0006 or later. On Unix-like systems, log files are opened with mode 0600 and O_NOFOLLOW, and an existing log file is used only if it is a regular file owned by the user running the application.
Workarounds
CNA: Leave Debug and CommLog disabled in production. If logging is needed, set Logdir in the driver's section of odbcinst.ini (PostgreSQL Unicode or PostgreSQL ANSI) to a directory writable only by the user running the application.