PT-2025-46820 · Microsoft+2 · Windows+2

Published 2025-11-05 · Updated 2025-12-12 · CVE-2025-12763

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions up to 9.9

Description pgAdmin 4 versions up to 9.9 on Windows systems are susceptible to a command injection issue. The root cause is the use of shell=True during backup and restore operations. This allows attackers to execute arbitrary system commands by providing specially crafted file path input. The vulnerable operations involve the use of file paths that are not properly sanitized before being passed to the system shell.

Recommendations Update pgAdmin to a version later than 9.9.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-14696

CVE-2025-12763

GHSA-RM79-X4G6-HVG5

OPENSUSE-SU-2025:15818-1

Affected Products

Pgadmin

Windows

Pgadmin 4

References · 18

• https://github.com/pgadmin-org/pgadmin4/issues/9323 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14696 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15818-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12763 · Security Note
• https://osv.dev/vulnerability/CVE-2025-12763 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rm79-x4g6-hvg5 · Vendor Advisory
• https://github.com/pgadmin-org/pgadmin4 · Note
• https://github.com/pgadmin-org/pgadmin4/commit/e374edc69239b3e02ecde895e27d9f9e488b87ee · Note
• https://t.me/cveNotify/143375 · Telegram Post
• https://suse.com/security/cve/CVE-2025-12764 · Note
• https://t.me/cveNotify/142640 · Telegram Post
• https://suse.com/security/cve/CVE-2025-12762 · Note
• https://suse.com/security/cve/CVE-2025-12765 · Note
• https://wiz.io/vulnerability-database/cve/cve-2025-12763 · Note
• https://suse.com/security/cve/CVE-2025-13780 · Note