CVE-2025-13780
Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
- Published
- Dec 11, 2025
- Updated
- Feb 26, 2026
- Assigning CNA
- PostgreSQL
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:LLow · next 30 days
- Percentile
- 60.3%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.
Sources
pgadmin/CVE-2025-13780
pgAdmin4 <= 9.10 Database Restore Tool Command Injection (CVE-2025-13780)
Vulhub vulnerability labsDeclared conditions
- lab image version: postgres:17-alpine(pgadmin/CVE-2025-13780/docker-compose.yml:services.pgsql.image)
- lab image version: vulhub/pgadmin:9.10(pgadmin/CVE-2025-13780/docker-compose.yml:services.web.image)
- CVE-2025-13780Scanner
A comprehensive vulnerability scanner for CVE-2025-13780, a Remote Code Execution (RCE) vulnerability in pgAdmin 4 versions ≤ 8.14.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.