medium6.8
CVE-2025-12763
pgAdmin 4 has command injection vulnerability on Windows systems
Impact
pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pgadmin4 | <= 9.9 | 9.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Pgadmin | Pgadmin 4 | before 9.10 |