# CVE-2025-12762: PYSEC-2026-454 - pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode

Source: https://junglewise.ai/threats/cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-13  
License: CC BY 4.0 with a link back

CVE-2025-12762 · Severity: critical · CVSS 9.1 · Published 2025-11-13

pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

Technologies: [Pgadmin 4](https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4), [pgadmin4 (PyPI)](https://junglewise.ai/threats/technologies/pgadmin4). Vendors: [pgAdmin](https://junglewise.ai/threats/vendors/pgadmin), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-12762 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-12762 being exploited in the wild.

**How severe is CVE-2025-12762?** Critical severity, with a CVSS score of 9.1, published 13 November 2025.

**Which products and versions are affected?** pgadmin4 (PyPI) ECOSYSTEM:introduced=0,fixed=9.10.

**Is there a fix for CVE-2025-12762?** Yes. pgadmin4 (PyPI): upgrade to 9.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-12762?** Check whether you run Pgadmin 4 or pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pgadmin4 (PyPI): upgrade to 9.10 or later

  ```sh
  pip install "pgadmin4>=9.10"
  ```


## Affected products

- Pgadmin 4
- pgadmin4 (PyPI) ECOSYSTEM:introduced=0,fixed=9.10

## Identifiers

- CVE-2025-12762
- GHSA-w2p4-p4rh-qcm3
- PYSEC-2026-454

## Related threats

- [pgAdmin 4 session invalidation failure after password change](https://junglewise.ai/threats/cve-2026-116251-pgadmin-4-did-not-invalidate-a-user-s-existing-sessions-when)
- [pgAdmin 4 path traversal in server credentials](https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl)
- [pgAdmin 4 unauthorized server sharing to all users](https://junglewise.ai/threats/cve-2026-116248-in-pgadmin-4-server-mode-only-administrators-are-meant-to-share)
- [pgAdmin credential injection via libpq service file](https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the)
- [pgAdmin 4 Kerberos credential exposure authentication bypass](https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user)