CVEvulnerability

CVE-2025-12762

9.8 CRITICAL Published 2025-11-13 Modified 2026-10-18 Official page ↗
Status
Modified
Published
2025-11-13
Last modified
2026-10-18
Assigner
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
CVSS 3.1 (f86ef6dc-4d3a-42ad-8f28-e6d5547a5007)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94

Description

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

Affected configurations

• pgadmin pgadmin 4 (< 9.10)

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References