PT-2025-46819 · Pgadmin · Pgadmin

Published

2025-11-04

·

Updated

2025-11-20

·

CVE-2025-12762

CVSS v3.1
9.8
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions pgAdmin versions up to 9.9
Description pgAdmin versions up to 9.9 are susceptible to a Remote Code Execution (RCE) issue that arises when operating in server mode and restoring from PLAIN-format dump files. This flaw permits attackers to inject and execute arbitrary commands on the server hosting pgAdmin, potentially compromising the database management system and its data. The vulnerability stems from improper handling of code injection during the restore process. The attack surface is the restore module processing PLAIN-format dumps in server mode, requiring low privileges and no user interaction.
Recommendations Versions prior to 9.10 are vulnerable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-14360
CVE-2025-12762
GHSA-W2P4-P4RH-QCM3

Affected Products

Pgadmin