CVE-2025-13780: Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.
Other sources
The PLAIN restore meta-command filter introduced in pgAdmin as part of the fix for CVE-2025-12762 does not detect meta-commands when a SQL file begins with a UTF-8 Byte Order Mark (EF BB BF) or other special byte sequences. The implemented filter uses the function hasmetacommands(), which scans raw bytes using a regular expression. The regex does not treat the bytes as ignorable, so meta-commands such as \\! remain undetected. When pgAdmin invokes psql with --file, psql strips the bytes and executes the command. This can result in remote command execution during a restore operation.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13780?
CVE-2025-13780 has a high severity due to its potential for Remote Code Execution.
How do I fix CVE-2025-13780?
To fix CVE-2025-13780, update pgAdmin to version 9.10 or later.
What systems are affected by CVE-2025-13780?
CVE-2025-13780 affects pgAdmin versions up to 9.10 when running in server mode.
Can CVE-2025-13780 be exploited remotely?
Yes, CVE-2025-13780 can be exploited remotely if the server hosting pgAdmin is vulnerable.
What kind of vulnerability is CVE-2025-13780?
CVE-2025-13780 is classified as a Remote Code Execution (RCE) vulnerability.