VYPR
← All advisories
Low severityNVD Advisory· Published Mar 7, 2022· Updated Aug 3, 2024

CVE-2022-26520

CVE-2022-26520

Description

In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In pgjdbc before 42.3.3, an attacker controlling JDBC connection properties can write arbitrary files via loggerFile and loggerLevel, potentially leading to RCE.

Vulnerability

In pgjdbc versions before 42.3.3, the driver accepts loggerFile and loggerLevel connection properties that are passed directly to java.util.logging.FileHandler. This allows an attacker who controls the JDBC URL or connection properties to write arbitrary files to the filesystem. The affected versions are all releases prior to 42.3.3 [2][4].

Exploitation

An attacker needs the ability to supply a full JDBC URL or connection properties (e.g., through an untrusted input field). By setting loggerFile to a writable path (such as a Tomcat web root) and loggerLevel to DEBUG, the driver creates a file with attacker-controlled content. For example, a JSP payload can be written to achieve code execution [2][4].

Impact

Successful exploitation allows arbitrary file write. In a typical web application server like Tomcat, an attacker can create an executable JSP file, leading to remote code execution with the privileges of the application server [2][4].

Mitigation

The vulnerability is fixed in pgjdbc version 42.3.3, where the loggerFile and loggerLevel properties are removed and ignored by the driver [4]. As a workaround, applications must sanitize any user-supplied JDBC URL or connection properties and never allow untrusted users to control them. The vendor considers this an application-level security issue rather than a driver defect [2].

References
  1. NVD - CVE-2022-26520
  2. Arbitrary File Write Vulnerability

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.postgresql:postgresqlMaven
>= 42.1.0, < 42.3.342.3.3

Affected products

37

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.