CVE-2025-13780

CriticalRCE

Published: 11 December 2025

Published

11 December 2025

Modified

19 December 2025

KEV Added

—

Patch

—

CVSS Score v3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

EPSS Score 0.0012 30.7th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-13780 is a critical-severity Code Injection (CWE-94) vulnerability in Pgadmin Pgadmin 4. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-13780 is a Remote Code Execution (RCE) vulnerability affecting pgAdmin versions up to and including 9.10. The issue arises when pgAdmin is running in server mode and performing restores from PLAIN-format dump files, enabling attackers to inject and execute arbitrary commands on the server hosting pgAdmin.

The vulnerability can be exploited remotely over the network by an attacker with low privileges, requiring low attack complexity and no user interaction. Successful exploitation allows arbitrary command execution on the host server, resulting in high confidentiality impact, low integrity and availability impacts, and a change in scope, as indicated by its CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) and association with CWE-94 (code injection).

Mitigation details and further information are available in the referenced GitHub issue at https://github.com/pgadmin-org/pgadmin4/issues/9368.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-202720

Vulnerability details

pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the…

server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

CWE(s): CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2025-13780 is an RCE vulnerability in the public-facing pgAdmin web application (server mode), directly enabling exploitation of public-facing applications via remote command injection during PLAIN-format dump restores.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0