Critical pgAdmin RCE (CVE-2025-13780) Flaw Bypasses Fix, Allowing Server Takeover Via Malicious Database Restore

A critical pgAdmin vulnerability (CVE-2025-13780) has been disclosed, permitting remote code execution by abusing a flaw in how file encoding is processed during a server-side database restore. The flaw scores 9.1 on the CVSS scale and enables an attacker to execute arbitrary commands on the host server, bypassing a prior fix that attempted to filter dangerous meta-commands from SQL dump files.

It affects pgAdmin versions up to 9.10 when running in server mode, with researchers noting a bypass chain that relies on a malicious plain SQL dump beginning with the UTF-8 BOM. The exploit bypasses the earlier filter by exploiting a mismatch between how pgAdmin scans files and how the psql utility processes them, allowing commands to run via the attacker’s payload. Administrators should check their version and apply mitigations or upgrade to pgAdmin 9.11 as a matter of urgency.

The article outlines the chain: a BOM-bearing dump is scanned as safe, passed to psql, which strips the BOM and executes the dangerous meta-command, potentially giving attackers full server control.