CVE-2025-12763: Command Injection Vulnerability in pgAdmin 4 on Windows Systems
Summary
CVE-2025-12763: pgAdmin 4 has command injection vulnerability on Windows systems. Affects pgadmin4 versions < 9.10. Fixed in 9.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pgAdmin 4 is a popular open-source administration and development platform for PostgreSQL, designed to provide a user-friendly interface for database management. It offers features such as query execution, database design, and backup/restore functionalities. However, certain versions of pgAdmin 4 are susceptible to a command injection vulnerability, particularly on Windows systems, which can be exploited by attackers to execute arbitrary commands.
Vulnerability Detail
The command injection vulnerability in pgAdmin 4 arises from the use of 'shell=True' during backup and restore operations. This design flaw allows attackers to craft malicious file path inputs that can execute arbitrary system commands. If exploited, this vulnerability could lead to unauthorized access, data manipulation, or system compromise, making it a significant security risk for users operating affected versions of the software.
How To Fix
Latest published version: 9.18.0 as of 22 Oct 2026
pip install --upgrade "pgadmin4==9.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.10
This is the first release that contains the fix.
pip install --upgrade "pgadmin4==9.10"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the backup and restore functionalities that involve file path inputs until they can update to the patched version. Additionally, consider implementing strict input validation to mitigate the risk of command injection.
Conclusion
The command injection vulnerability in pgAdmin 4 poses a significant risk to users on Windows systems. It is crucial to update to the patched version 9.10 or later to mitigate this risk. Users should also consider implementing workarounds and monitoring tools like Vulert to stay informed about potential vulnerabilities in their software.
See every vulnerability recorded for pgadmin4 →
FAQ
pgAdmin 4 versions up to 9.9 are affected by this command injection vulnerability.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized command execution, data loss, or system compromise.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just the Pipfile.lock.
References
Related vulnerabilities
Recent vulnerabilities recorded for pgadmin4.
