CVE-2025-12762: pgAdmin4 Remote Code Execution Vulnerability in Server Mode
Summary
CVE-2025-12762: pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode. Affects pgadmin4 versions < 9.10. Fixed in 9.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pgAdmin4 is a popular open-source administration and development platform for PostgreSQL, allowing users to manage databases through a web interface. It supports various features such as query execution, database design, and data visualization. However, versions up to 9.9 are vulnerable to a critical Remote Code Execution (RCE) vulnerability when running in server mode, particularly during restores from PLAIN-format dump files.
Vulnerability Detail
The vulnerability arises from the way pgAdmin4 handles PLAIN-format dump files in server mode. Attackers can exploit this flaw by injecting malicious commands into the dump files, which can then be executed on the server. This poses a significant risk as it allows unauthorized users to gain control over the server, potentially compromising the integrity and security of the database management system and the underlying data.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.10
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==9.10"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable server mode or avoid restoring from PLAIN-format dump files until the package is updated to a secure version.
Conclusion
The Remote Code Execution vulnerability in pgAdmin4 poses a critical risk to users running versions up to 9.9 in server mode. It is essential to update to version 9.10 or later to safeguard against potential attacks. Additionally, users can implement temporary workarounds while awaiting the update.
See every vulnerability recorded for pgadmin4 →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
pgAdmin4 versions up to 9.9 are affected by this vulnerability.
If exploited, attackers can execute arbitrary commands on the server, potentially gaining unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just the Pipfile.lock of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
