CVE-2025-12763: Command injection vulnerability allowing arbitrary command execution on Windows
Published Nov 13, 2025
·Updated
pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.
Affected Software
4 affected componentsFixes available
PostgreSQL pgAdmin 4<9.9
pip/pgadmin4<=9.9
9.10
All of the following
pgAdmin Pgadmin 4 Postgresql<9.10
Microsoft Windows
Event History
Nov 13, 2025
CVE Published
via MITRE·01:00 PM
Data Sourced
via MITRE·01:00 PM
DescriptionSeverity
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·03:30 PM
Data Sourced
via GitHub·03:30 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-12763?
CVE-2025-12763 has a high severity rating due to its potential for remote code execution on affected systems.
2
How do I fix CVE-2025-12763?
To fix CVE-2025-12763, upgrade pgAdmin 4 to version 9.10 or later, where the vulnerability is resolved.
3
Who is affected by CVE-2025-12763?
CVE-2025-12763 affects all Windows users of pgAdmin 4 versions up to 9.9.
4
What type of vulnerability is CVE-2025-12763?
CVE-2025-12763 is a command injection vulnerability that allows execution of arbitrary system commands.
5
When was CVE-2025-12763 reported?
CVE-2025-12763 was reported in early 2025 and is associated with pgAdmin 4.