Critical pgAdmin Flaws (CVE-2025-12762, CVSS 9.1) Allow Remote Code Execution via PostgreSQL Dump Files

The pgAdmin development team has issued patches addressing four newly disclosed vulnerabilities affecting pgAdmin versions up to 9.9, including a critical Remote Code Execution flaw that could allow attackers to run arbitrary commands on affected servers.

The most severe issue, CVE-2025-12762 (CVSS 9.1), occurs when pgAdmin is running in server mode and performing restores from PLAIN-format PostgreSQL dump files, with attackers able to craft malicious dump files to inject system‑level commands and fully compromise the host.

Other listed flaws include CVE-2025-12763 (CVSS 6.8) for command injection on Windows during backup and restore actions, CVE-2025-12764 (CVSS 7.5) an LDAP injection in the LDAP authentication flow, and CVE-2025-12765 (CVSS 7.5) a TLS certificate verification bypass in the LDAP mechanism. Administrators are urged to update to the latest secure release, v9.10, as all versions up to 9.9 are affected.

The article notes that these issues underscore significant risks to the database management system and underlying data when pgAdmin is deployed in enterprise environments.