pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.
References
| Link | Resource |
|---|---|
| https://github.com/pgadmin-org/pgadmin4/issues/9323 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
19 Nov 2025, 16:05
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
|
| CWE | CWE-78 | |
| First Time |
Pgadmin
Pgadmin pgadmin 4 Microsoft Microsoft windows |
|
| References | () https://github.com/pgadmin-org/pgadmin4/issues/9323 - Issue Tracking, Vendor Advisory |
13 Nov 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-13 13:15
Updated : 2025-11-19 16:05
NVD link : CVE-2025-12763
Mitre link : CVE-2025-12763
CVE.ORG link : CVE-2025-12763
JSON object : View
Products Affected
pgadmin
- pgadmin_4
microsoft
- windows
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')