PT-2025-14903 · Aiven · Aiven-Extras

Published 2025-04-04 · Updated 2025-04-05 · CVE-2025-31480

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions aiven-extras versions prior to 1.1.16

Description This issue is a privilege escalation vulnerability that allows elevation to superuser inside PostgreSQL databases using the aiven-extras package. It leverages the format function not being schema-prefixed.

Recommendations For versions prior to 1.1.16, install version 1.1.16 and run the command ALTER EXTENSION aiven extras UPDATE TO '1.1.16' in each database where aiven extras has been installed.

Exploit

Fix

LPE

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2025-31480

GHSA-33XH-JQGF-6627

Affected Products

Aiven-Extras

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31480.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-31480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31480 · Security Note
• https://github.com/aiven/aiven-extras/commit/77b5f19a0c1d196bc741ff5c774f85fe7ca3063b · Note
• https://github.com/aiven/aiven-extras/security/advisories/GHSA-33xh-jqgf-6627 · Note
• https://twitter.com/CVEnew/status/1908438474794860866 · Twitter Post
• https://t.me/cvedetector/22130 · Telegram Post