CVE-2025-12763
pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.
- CVSS 3.1
- 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-25)
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pgadmin:pgadmin_4
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rm79-x4g6-hvg5 | PyPI | pgadmin4 | <9.10 | 9.10 |
| PYSEC-2026-1776 | PyPI | pgadmin4 | <9.10 | 9.10 |