CVE-2025-8715 PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server

High 8.8 Published 14 Aug 2025 Updated 26 Feb 2026

Attacker injects code via object names in pg_dump, enabling arbitrary code execution on the client and superuser SQL injection on the restore target.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-8715?

CVE-2025-8715 is a high-severity code injection vulnerability in PostgreSQL, published on 14 Aug 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.

Weakness: CWE-93

Which versions are affected by CVE-2025-8715?

1 open source package ship an affected version, including postgresql.

Package	Affected	Fixed in
`postgresql` Bitnami	From `11.20.0`	`13.22.0, 14.19.0, 15.14.0, 16.10.0, 17.6.0`

Linux distribution packages (34)

`pg_repack` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.4.6-3.module+el8.9.0+19330+c97ddbdf`
`pg_repack-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.4.6-3.module+el8.9.0+19330+c97ddbdf`
`pg_repack-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.4.6-3.module+el8.9.0+19330+c97ddbdf`
`pgaudit` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.4.0-7.module+el8.10.0+22214+9beb89d6`
`pgaudit-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.4.0-7.module+el8.10.0+22214+9beb89d6`
`pgaudit-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.4.0-7.module+el8.10.0+22214+9beb89d6`
`postgres-decoderbufs` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.10.0-2.module+el8.9.0+19330+c97ddbdf`
`postgres-decoderbufs-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.10.0-2.module+el8.9.0+19330+c97ddbdf`
`postgres-decoderbufs-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.10.0-2.module+el8.9.0+19330+c97ddbdf`
`postgresql` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-contrib` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-contrib-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-docs` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-docs-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-plperl` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-plperl-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-plpython3` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-plpython3-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-pltcl` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-pltcl-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-server` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-server-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-server-devel` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-server-devel-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-static` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-test` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-test-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-test-rpm-macros` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-upgrade` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-upgrade-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-upgrade-devel` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`
`postgresql-upgrade-devel-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:12.22-5.module+el8.10.0+23469+cd66ea30`

How do I fix CVE-2025-8715?

Upgrade postgresql to a fixed version for your release line: 13.22.0, 14.19.0, 15.14.0 or 16.10.0.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-8715 being exploited?

There is no known exploitation of CVE-2025-8715 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2025-8715, AZL-66306, AZL-66327, BELL-CVE-2025-8715, BIT-postgresql-2025-8715, CLEANSTART-2026-NE41969 and 10 more.