CVE-2025-12763: Command injection vulnerability allowing arbitrary command execution on Windows
pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pgadmin4to a version that resolves this vulnerability.Fixed in 9.10
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12763?
CVE-2025-12763 has a high severity rating due to its potential for remote code execution on affected systems.
How do I fix CVE-2025-12763?
To fix CVE-2025-12763, upgrade pgAdmin 4 to version 9.10 or later, where the vulnerability is resolved.
Who is affected by CVE-2025-12763?
CVE-2025-12763 affects all Windows users of pgAdmin 4 versions up to 9.9.
What type of vulnerability is CVE-2025-12763?
CVE-2025-12763 is a command injection vulnerability that allows execution of arbitrary system commands.
When was CVE-2025-12763 reported?
CVE-2025-12763 was reported in early 2025 and is associated with pgAdmin 4.