CVE-2025-12762CWE-94code-injection

CVE-2025-12762

Critical · published November 13, 2025

CVSS v3.1
9.1
EPSS
13%
Percentile
96.3
In the wild
Unconfirmed
What it is

🚨 pgAdmin versions up to 9.9 are vulnerable to a critical Remote Code Execution (RCE) flaw that lets attackers run commands on your server as easily as hitting 'play' on a video. This is a BIG deal! 🔥 Think of pgAdmin like a restaurant kitchen. If the chef (your server) trusts a delivery of ingredients (the dump file) without checking its quality, they might unwittingly cook up something harmful, like a dangerous dish that poisons the whole dining experience. With this vulnerability, an attacker could execute arbitrary commands on your pgAdmin server, leading to potentially devastating consequences. Imagine someone having the keys to your kitchen, allowing them to tamper with recipes, steal ingredients, or even shut down the whole operation. Any data integrity and security could be at risk!

Put simply

Think of pgAdmin like a restaurant kitchen. If the chef (your server) trusts a delivery of ingredients (the dump file) without checking its quality, they might unwittingly cook up something harmful, like a dangerous dish that poisons the whole dining experience. This RCE vulnerability occurs specifically when pgAdmin is running in server mode and restores from PLAIN-format dump files, allowing an attacker to inject malicious commands via crafted dump files.

What to do

With this vulnerability, an attacker could execute arbitrary commands on your pgAdmin server, leading to potentially devastating consequences. Imagine someone having the keys to your kitchen, allowing them to tamper with recipes, steal ingredients, or even shut down the whole operation. Any data integrity and security could be at risk! To protect your server, immediately upgrade pgAdmin to the latest version, ensuring you deploy any patches provided. Additionally, review your server configuration to limit restore commands to trusted sources only. Don't skip this step! You've got this! Follow these steps and lock down your pgAdmin environment like the security hero you are! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.12705 · 96.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-11-13T18:15Z
Affected products (1)
ProductVersionsFixed in
pgadmin/pgadmin_4< 9.109.10
References (1)
EPSS history
Timeline
  • 13 NOV 13:00Z
    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
    cvelistv5