Skip to main content

Pgadmin 4 CVE-2025-2945

CRITICAL
Code Injection (CWE-94)
2025-04-03 f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
RCE Python Code Injection Pgadmin 4 Suse Pgadmin
9.9
CVSS 3.1 · NVD
View

Vulnerability Assessment

Weakness
CWE
CWE-94
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS 9.9, EPSS 77.9%, PoC available. pgAdmin is the most popular PostgreSQL administration tool, widely deployed in development and production environments. The pgAdmin server process typically has database superuser credentials configured. RCE leads to both server compromise and full database access.
Exploit ScenarioDerived

An attacker with a pgAdmin account (which may have weak/default credentials) sends a POST to /sqleditor/query_tool/download with query_commited=__import__('os').popen('id').read(). The eval() function executes the payload, returning OS command output. The attacker escalates to a reverse shell, extracts PostgreSQL superuser credentials from pgAdmin's configuration, and gains full control of all managed databases.
Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.
Patch available 77.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 28, 2026

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoints. The query_commited and high_availability parameters are passed directly to Python's eval() function, allowing authenticated users to execute arbitrary Python code on the pgAdmin server.

Earlier versions of this analysis (1)
v1 Mar 28, 2026 - 18:34 CVSS 9.9

RCE in pgAdmin 4 via unsafe eval() usage in Query Tool and Cloud Deployment modules allows authenticated arbitrary code execution.

RemediationAI

Update pgAdmin 4 to the latest patched version. Restrict pgAdmin access to trusted users and networks. Use strong authentication for all pgAdmin accounts. Run pgAdmin in a container with minimal filesystem and network access. Monitor pgAdmin logs for suspicious query tool download requests.

Affected Packages

pypi pgadmin4 fix: 9.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Two POST endpoints are affected: /sqleditor/query_tool/download (query_commited parameter) and /cloud/deploy (high_availability parameter). Both parameters are passed directly to Python's eval() function without sanitization. An authenticated pgAdmin user can inject arbitrary Python expressions that execute in the server's context with the pgAdmin process privileges.

Know when Pgadmin 4 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.9 CRITICAL
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SUSE CRITICAL

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
PoC Detected
Sep 17, 2025 - 18:04 vuln.today
Public exploit code
CVE Published
Apr 03, 2025 - 13:15 nvd
CRITICAL 9.9

DescriptionCVE.org

Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules).

The vulnerability is associated with the 2 POST endpoints; /sqleditor/query_tool/download, where the query_commited parameter and /cloud/deploy endpoint, where the high_availability parameter is unsafely passed to the Python eval() function, allowing arbitrary code execution.

This issue affects pgAdmin 4: before 9.2.

Executive ViewAI

Why It Matters

CVE-2025-2945 presents critical security risk, a code injection vulnerability rated CVSS 9.9. Successful exploitation could allow attackers to execute arbitrary code or commands on affected systems, potentially leading to full system compromise. With an EPSS score of 78%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Deploy WAF rules to block injection patterns; (2) Restrict network access to affected components; (3) Enable enhanced logging for suspicious activity.

Threat Intelligence Overview

Threat Score
5.8/10
Composite threat intelligence
EPSS Score
77.9%
Top 1% exploitable
Exploit
POC
Public exploit code exists
Data Quality
6 sources
Confidence: High
NVD CVE.org EPSS POC (1) Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC Yes
EPSS 77.9%
Patch available Yes
Active threat Yes
Deciding rule
CRITICAL severity + public POC available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
No
Human Impact
Very High

Priority Score

163
Low Medium High Critical
KEV: 0
EPSS: +78
CVSS: +50
PoC: +20
Weaponized: +15
Threat intel: 0
Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Affected Products (CPE)CVE.org

cpe:2.3:a:pgadmin:pgadmin_4:*:*:*:*:*:postgresql:*:*

More in Pgadmin 4

View all
CVE-2024-2044 CRITICAL POC
9.9 Mar 07

pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling
CVE-2024-3116 CRITICAL POC
9.8 Apr 04

pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. Rated cr
CVE-2022-4223 HIGH POC
8.8 Dec 13

The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external Post
CVE-2024-9014 MEDIUM POC
6.5 Sep 23

pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. Rated medium severity (CVS
CVE-2026-12046 CRITICAL
9.5 Jun 18

Remote unauthenticated access to two SQL Editor endpoints in pgAdmin 4 server-mode deployments (versions 6.9 through 9.1
CVE-2026-12045 CRITICAL
9.4 Jun 18

Remote SQL injection via prompt injection in pgAdmin 4 versions 9.13 through 9.15 allows attackers who can write content
CVE-2026-17351 CRITICAL
9.4 Jul 31

SQL injection sandbox escape in pgAdmin 4's AI Assistant (versions 9.13 through 9.16) lets an attacker break out of the

CVE-2026-17566 CRITICAL
9.4 Jul 31

OS command injection in pgAdmin 4 (all versions before 9.18) lets an authenticated user with the commonly-granted tools_
CVE-2026-7813 CRITICAL
9.4 May 11

Authorization bypass and privilege escalation in pgAdmin 4 server mode allows authenticated users to access other users'
CVE-2024-4216 MEDIUM POC
5.4 May 02

pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. Rated medium severity (CVS
CVE-2026-86863 CRITICAL
9.3 Sep 17

Authentication bypass in pgAdmin 4 (versions 6.2 through 9.17) lets any client that can reach the pgAdmin web interface

CVE-2026-12048 CRITICAL
9.3 Jun 18

Stored cross-site scripting in pgAdmin 4 versions 6.0 through 9.15 allows a malicious or attacker-influenced PostgreSQL

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Python 3 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:14983/

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy