CVE-2025-13780

CriticalRCE

Published: 11 December 2025

Published

11 December 2025

Modified

19 December 2025

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

EPSS Score 0.0010 27.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13780 is a critical-severity Code Injection (CWE-94) vulnerability in Pgadmin Pgadmin 4. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the RCE vulnerability in pgAdmin by applying vendor-provided patches to versions beyond 9.10.

SI-10 Information Input Validation good match

prevent

Validates PLAIN-format dump file inputs to prevent command injection during pgAdmin server-mode restores.

AC-6 Least Privilege partial match

prevent

Enforces least privilege for pgAdmin server processes to limit the impact of successful RCE command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2025-13780 is an RCE vulnerability in the public-facing pgAdmin web application (server mode), directly enabling exploitation of public-facing applications via remote command injection during PLAIN-format dump restores.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the…

server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

Deeper analysisAI

CVE-2025-13780 is a Remote Code Execution (RCE) vulnerability affecting pgAdmin versions up to and including 9.10. The issue arises when pgAdmin is running in server mode and performing restores from PLAIN-format dump files, enabling attackers to inject and execute arbitrary commands on the server hosting pgAdmin.

The vulnerability can be exploited remotely over the network by an attacker with low privileges, requiring low attack complexity and no user interaction. Successful exploitation allows arbitrary command execution on the host server, resulting in high confidentiality impact, low integrity and availability impacts, and a change in scope, as indicated by its CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and association with CWE-94 (code injection).

Mitigation details and further information are available in the referenced GitHub issue at https://github.com/pgadmin-org/pgadmin4/issues/9368.