PT-2025-46819 · Pgadmin+1 · Pgadmin+1

CVE-2025-12762 · Published 2025-11-04 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pgAdmin versions up to 9.9

Description pgAdmin is susceptible to a Remote Code Execution (RCE) issue that arises when operating in server mode and restoring from PLAIN-format dump files. This flaw allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, potentially leading to a complete compromise of the server environment. Reports indicate approximately 7,393 to 14,466 potentially vulnerable instances are currently detectable. The vulnerability stems from improper handling of code injection during server-mode restores from PLAIN-format dump files, where pgAdmin fails to adequately sanitize inputs. The vulnerability is exploitable without user interaction and has a low complexity.

Recommendations Upgrade to pgAdmin4 version 9.10 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-14360

CVE-2025-12762

GHSA-W2P4-P4RH-QCM3

OPENSUSE-SU-2025:15818-1

PYSEC-2026-454

Affected Products

Pgadmin

Red Os

References · 52

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12762.json · Exploit
• https://github.com/pgadmin-org/pgadmin4/issues/9320 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14360 · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12762 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-454 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12762 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w2p4-p4rh-qcm3 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15818-1 · Vendor Advisory
• https://github.com/pgadmin-org/pgadmin4 · Note
• https://github.com/pgadmin-org/pgadmin4/commit/1d397395f75320ca1d4ed5e9ca721c603415e836 · Note
• https://t.me/pentestingnews/70993 · Telegram Post
• https://suse.com/security/cve/CVE-2025-12765 · Note
• https://twitter.com/N3mes1s/status/1989433649641787876 · Twitter Post
• https://github.com/advisories/GHSA-w2p4-p4rh-qcm3 · Note