CVE-2025-12763 Command injection vulnerability allowing arbitrary command execution on Windows

Medium 6.8 Published 13 Nov 2025 Updated 26 Feb 2026

Attackers can execute arbitrary system commands on Windows via crafted file paths during backup or restore operations in pgAdmin 4.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-12763?

CVE-2025-12763 is a medium-severity command injection vulnerability in pgadmin.org pgAdmin 4, published on 13 Nov 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system commands by providing specially crafted file path input.

Weakness: CWE-78

Which versions are affected by CVE-2025-12763?

3 open source packages ship an affected version, including pgadmin4. It affects 1 product.

Package	Affected	Fixed in
`pgadmin4` PyPI	All versions	`9.10`
`pgadmin4` PyPI	All versions	`9.10`
`pgadmin4` PyPI	All versions	`9.10`

Products include Pgadmin Pgadmin 4.

How do I fix CVE-2025-12763?

Upgrade pgadmin4 to 9.10 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-12763 being exploited?

There is no known exploitation of CVE-2025-12763 in the wild and no public exploit code.

Sources

Also known as GHSA-rm79-x4g6-hvg5, PYSEC-2026-1776.