CVE-2025-12762

CRITICAL9.1

Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

Published Nov 13, 2025

Modified 3 months ago

Details

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

References

WEB

https://github.com/pgadmin-org/pgadmin4/issues/9320

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-12762

CVSS Analysis

CVSS v3.1

9.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

LowI:L

Availability

LowA:L

9.1/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Ecosystems

Timeline

PublishedNov 13, 2025

ModifiedFeb 26, 2026