CVE-2025-12762: pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode

November 13, 2025

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

References

github.com/advisories/GHSA-w2p4-p4rh-qcm3
github.com/pgadmin-org/pgadmin4
github.com/pgadmin-org/pgadmin4/commit/1d397395f75320ca1d4ed5e9ca721c603415e836
github.com/pgadmin-org/pgadmin4/issues/9320
nvd.nist.gov/vuln/detail/CVE-2025-12762

Code Behaviors & Features

Detect and mitigate CVE-2025-12762 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →