PT-2025-33268 · Unknown+13 · Postgresql+12
Martin Rakhmanov
+2
·
Published
2025-08-13
·
Updated
2026-04-02
·
CVE-2025-8714
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
PostgreSQL versions prior to 17.6
PostgreSQL versions prior to 16.10
PostgreSQL versions prior to 15.14
PostgreSQL versions prior to 14.19
PostgreSQL versions prior to 13.22
Description:
The vulnerability relates to untrusted data inclusion within the
pg dump utility. Exploitation allows a malicious superuser of the origin server to inject arbitrary code for execution during restore operations performed by the psql client. This affects pg dumpall and pg restore when used to generate plain-format dumps. Approximately 3.3 million devices are estimated to be affected. The issue allows for remote code execution.Recommendations:
Update to PostgreSQL version 17.6 or later.
Update to PostgreSQL version 16.10 or later.
Update to PostgreSQL version 15.14 or later.
Update to PostgreSQL version 14.19 or later.
Update to PostgreSQL version 13.22 or later.
As a temporary workaround, use the
--no-comments option during pg restore operations.Fix
RCE
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Debian
Ibm Aix
Linuxmint
Postgresql
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu
Zvirt Node