CVE-2025-8715: PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server
Improper neutralization of newlines in pgdump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pgdumpall, pgrestore, and pgupgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.
Other sources
PostgreSQL pgdump newline in object name executes arbitrary code in psql client and in restore target server
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8715?
CVE-2025-8715 has been classified as a high-severity vulnerability due to the potential for arbitrary code execution during the restore process.
How do I fix CVE-2025-8715?
To mitigate CVE-2025-8715, upgrade PostgreSQL to version 13.23 or later, or version 11.21 or later if using the older series.
Who is affected by CVE-2025-8715?
CVE-2025-8715 affects users of PostgreSQL versions prior to 11.21 and between 13.22 and 17.6, specifically during the use of pg_dump and related tools.
What impact does CVE-2025-8715 have on PostgreSQL users?
CVE-2025-8715 can allow attackers to execute arbitrary code on the PostgreSQL server operating system during the restoration of a compromised dump.
Is there a workaround for CVE-2025-8715 before upgrading?
A temporary workaround for CVE-2025-8715 is to avoid using pg_dump for generating dumps that may include untrusted data until the software is upgraded.