PT-2025-46819 · Pgadmin+1 · Pgadmin+1

Published

2025-11-04

·

Updated

2026-02-20

·

CVE-2025-12762

CVSS v3.1
9.8
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions pgAdmin versions up to 9.9
Description pgAdmin is susceptible to a Remote Code Execution (RCE) issue that arises when operating in server mode and restoring from PLAIN-format dump files. This flaw allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, potentially leading to a complete compromise of the server environment. Reports indicate approximately 7,393 to 14,466 potentially vulnerable instances are currently detectable. The vulnerability stems from improper handling of code injection during server-mode restores from PLAIN-format dump files, where pgAdmin fails to adequately sanitize inputs. The vulnerability is exploitable without user interaction and has a low complexity.
Recommendations Upgrade to pgAdmin4 version 9.10 or later.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-14360
CVE-2025-12762
GHSA-W2P4-P4RH-QCM3
OPENSUSE-SU-2025:15818-1

Affected Products

Pgadmin
Red Os