CVE-2025-12762

Published: Nov 13, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

Affected (1)

Products: Pgadmin: Pgadmin 4

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Pgadmin Pgadmin 4	Before 9.10

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (1)

https://github.com/pgadmin-org/pgadmin4/issues/9320

Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Issue TrackingVendor Advisory

Timeline

No history available yet.