CVE-2026-116330: PostgreSQL pg_dump tar restore.sql fails to block psql command injection
Untrusted data inclusion in PostgreSQL pgdump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Clients using pg_dump tar-format output from a compromised origin server are exposed if they execute the included restore.sql with psql. The code runs as the client operating system account that runs psql.
What must an attacker be able to do to exploit it?
The attacker must control or compromise the origin PostgreSQL server so it can supply untrusted content in the tar-format dump's restore.sql. Exploitation also requires a user or process to run that restore.sql using psql.
Are default PostgreSQL installations affected?
The issue applies specifically to the undocumented restore.sql included in pg_dump tar-format output and requires that file to be executed with psql. The provided information does not establish whether ordinary default backup and restore workflows execute restore.sql.
Which versions should be remediated?
Upgrade to PostgreSQL 18.7, 17.12, 16.16, 15.20, or 14.25, as applicable. Earlier versions in those release branches are affected.