Path Traversal in PostgreSQL pg_basebackup and pg_rewind

Successful exploitation allows an origin-side PostgreSQL superuser to overwrite arbitrary files writable by the local account executing pg_basebackup or pg_rewind. The primary security consequence is operating system account hijack, which can in turn enable privilege abuse, persistence, or execution of attacker-controlled commands in the context of the PostgreSQL service account. PostgreSQL notes that server startup already implicitly trusts the origin superuser through existing mechanisms such as shared_preload_libraries, so the practical impact is most significant when administrators take intermediate actions after running the vulnerable utility and before starting the server, such as moving the resulting files to another virtual machine or creating a snapshot.

If immediate patching is not possible, do not use pg_basebackup in plain format or pg_rewind against untrusted or insufficiently trusted origin systems, especially where the origin superuser may be hostile. Avoid performing operational steps between execution of these tools and server startup that would preserve or transfer attacker-written files into another environment, such as snapshotting, imaging, or moving the data directory to a different host. Restrict who can act as origin superuser and tightly control replication and backup trust boundaries until patched releases are deployed.

Upgrade PostgreSQL to a fixed minor release appropriate for the deployed branch: 18.4, 17.10, 16.14, 15.18, or 14.23, or later. The fix prevents unsafe path handling in pg_basebackup and pg_rewind by rejecting invalid output paths derived from input.