External risk intelligence

pgAdmin 4 Remote Code Execution via PLAIN Restore

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-12762

pgAdmin is a management interface for PostgreSQL databases. When deployed in server mode, it is commonly exposed as a web-based portal to allow administrators to manage databases remotely. This network-accessible surface is a frequent entry point, making it likely to be reachable from the internet or exposed across network segments in typical deployment patterns.

Code Injection

Pgadmin 4

before 9.10

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in pgAdmin's server mode allows remote code execution through specially crafted restore files, potentially compromising database management systems and sensitive data.

Remote code execution flaw in pgAdmin.
Database security and data integrity risk.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could compromise a pgAdmin server by crafting a malicious PLAIN-format dump file. When pgAdmin, running in server mode, processes this file during a restore operation, it can be tricked into executing arbitrary commands on the server. This could lead to a full takeover of the database management system and its data.

No authentication needed to trigger.
Restore operation from a malicious dump file.
Full remote code execution on server.

Live Threat

Current exploitation, exposure, and threat context

When pgAdmin is running in server mode and handling PLAIN-format restores, an attacker could execute arbitrary commands on the server. This could potentially impact the integrity and security of the database management system and the data it stores.

Database server integrity and data.
Arbitrary command execution during restore.
Compromise of database management system.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for managing PostgreSQL databases and their associated administrative tools, such as infrastructure or platform teams, should prioritize addressing this vulnerability. The first practical step is to identify all instances of the affected pgAdmin version, confirm their network exposure and business criticality, and then ascertain the specific owner for each instance to plan remediation.

Database and platform teams own remediation.
Verify pgAdmin server mode network exposure.
Plan maintenance for affected instances.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is pgAdmin 4?

pgAdmin 4 is a widely used, web-based graphical management interface for PostgreSQL databases. It acts as a central portal, allowing administrators to configure, monitor, and maintain their database environments remotely. When deployed in server mode, it provides a browser-accessible platform to manage multiple databases through a unified dashboard.

What does CWE-94 mean for CVE-2025-12762?

This vulnerability is classified as CWE-94, which refers to the Improper Control of Generation of Code. In the context of CVE-2025-12762, it means the application does not sufficiently validate input. An attacker can supply a malicious file that the software treats as legitimate code, resulting in the server executing unintended and arbitrary commands.

How is this vulnerability triggered?

The flaw is triggered when pgAdmin, running in server mode, processes a restore operation using a specially crafted PLAIN-format dump file. It is important to note that this bug is specific to that file format and action; restores from other formats or operations that do not involve processing these specific dump files do not trigger the vulnerability.

Is my pgAdmin instance at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant if your pgAdmin instance is deployed in server mode and reachable over the network. Because this software is often configured as a web portal, it is frequently exposed to broader network segments or the internet, significantly increasing the likelihood that an attacker could reach the service.

What should I do first to secure my systems?

Begin by creating a comprehensive inventory of all pgAdmin instances in your environment to identify which systems are running affected versions. Once located, verify the network configuration for each server to understand its accessibility and determine which instances are most critical to your operations. Use this information to coordinate with the responsible infrastructure or platform teams to plan maintenance.

References

github.com/pgadmin-org/pgadmin4/issues/9320

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.