CVE-2025-31480 aiven-extras allows PostgreSQL Privilege Escalation through format function
Attackers can escalate privileges to superuser in PostgreSQL databases using the aiven-extras extension due to improper schema qualification.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-31480?
CVE-2025-31480 is a critical vulnerability in aiven-extras, published on 4 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
aiven-extras is a PostgreSQL extension. This is a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL databases that use the aiven-extras package. The vulnerability leverages the format function not being schema-prefixed. Affected users should install 1.1.16 and ensure they run the latest version issuing ALTER EXTENSION aiven_extras UPDATE TO '1.1.16' after installing it. This needs to happen in each database aiven_extras has been installed in.
Weakness: CWE-426
Which versions are affected by CVE-2025-31480?
How do I fix CVE-2025-31480?
No fix has been published for CVE-2025-31480 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-31480 being exploited?
There is no known exploitation of CVE-2025-31480 in the wild and no public exploit code.
Sources
Also known as GHSA-33xh-jqgf-6627.