CVE-2025-13780 Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

What is CVE-2025-13780?

CVE-2025-13780 is a critical code injection vulnerability in pgadmin.org pgAdmin 4, published on 11 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

Weakness: CWE-94

Which versions are affected by CVE-2025-13780?

3 open source packages ship an affected version, including pgadmin4. It affects 1 product.

Products include Pgadmin Pgadmin 4.

How do I fix CVE-2025-13780?

Upgrade pgadmin4 to 9.11 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-13780 being exploited?

There is no known exploitation of CVE-2025-13780 in the wild and no public exploit code.

Public exploit code: 3 proofs of concept on GitHub.

Other vulnerabilities in pgadmin.org pgAdmin 4

• CVE-2025-2945 pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment Critical 9.9
• CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4 Critical 9.9
• CVE-2026-12046 Deserialization in pgAdmin 4 Critical 9.5
• CVE-2026-17351 SQL injection in pgAdmin 4 Critical 9.4
• CVE-2026-17566 Command injection in pgAdmin 4 Critical 9.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fxmw-jcgr-w44v, PYSEC-2026-450.