Cyber Posture

CVE-2025-13780

Critical

Published: 11 December 2025

Published
11 December 2025
Modified
19 December 2025
KEV Added
—
Patch
—
CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
EPSS Score 0.0017 38.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the…

more

server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the RCE vulnerability in pgAdmin by applying vendor-provided patches to versions beyond 9.10.

SI-10 Information Input Validation good match
prevent

Validates PLAIN-format dump file inputs to prevent command injection during pgAdmin server-mode restores.

AC-6 Least Privilege partial match
prevent

Enforces least privilege for pgAdmin server processes to limit the impact of successful RCE command execution.

Security SummaryAI

CVE-2025-13780 is a Remote Code Execution (RCE) vulnerability affecting pgAdmin versions up to and including 9.10. The issue arises when pgAdmin is running in server mode and performing restores from PLAIN-format dump files, enabling attackers to inject and execute arbitrary commands on the server hosting pgAdmin.

The vulnerability can be exploited remotely over the network by an attacker with low privileges, requiring low attack complexity and no user interaction. Successful exploitation allows arbitrary command execution on the host server, resulting in high confidentiality impact, low integrity and availability impacts, and a change in scope, as indicated by its CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and association with CWE-94 (code injection).

Mitigation details and further information are available in the referenced GitHub issue at https://github.com/pgadmin-org/pgadmin4/issues/9368.

Details

CWE(s)
CWE-94

Affected Products

pgadmin
pgadmin 4
≤ 9.10

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CVE-2025-13780 is an RCE vulnerability in the public-facing pgAdmin web application (server mode), directly enabling exploitation of public-facing applications via remote command injection during PLAIN-format dump restores.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References