CVE-2025-12763 — Command injection vulnerability allowing arbitrary command execution on Windows

CVE-2025-12763

Command injection vulnerability allowing arbitrary command execution on Windows PUBLISHED

Description (CNA)

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.

Affected (CNA)

Vendor / product	Versions
pgadmin.org / pgAdmin 4	affected 0 through 9.9

CWE

No CWE identifiers supplied.

References

https://github.com/pgadmin-org/pgadmin4/issues/9323

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.