PT-2025-46819 · Pgadmin · Pgadmin

Published

2025-11-04

·

Updated

2026-01-10

·

CVE-2025-12762

CVSS v3.1
9.8
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions pgAdmin versions up to 9.9 pgAdmin versions 9.9 and earlier
Description pgAdmin versions up to 9.9 are susceptible to a Remote Code Execution (RCE) issue that arises when operating in server mode and restoring from PLAIN-format dump files. This flaw permits attackers to inject and execute arbitrary commands on the server hosting pgAdmin, potentially compromising the database management system and its underlying data. Approximately 14,466 to 7,393 potentially vulnerable instances have been observed. The vulnerability stems from improper handling of code injection during server-mode restores from PLAIN-format dump files, where pgAdmin fails to adequately sanitize inputs. Successful exploitation could lead to a full system compromise.
Recommendations Upgrade to pgAdmin4 version 9.10 or later. Disable server mode to mitigate the risk.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-14360
CVE-2025-12762
GHSA-W2P4-P4RH-QCM3
OPENSUSE-SU-2025:15818-1

Affected Products

Pgadmin