# CVE-2025-13780: PYSEC-2026-450 - pgadmin4 has a Meta-Command Filter Command Execution

Source: https://junglewise.ai/threats/cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-11  
License: CC BY 4.0 with a link back

CVE-2025-13780 · Severity: critical · CVSS 9.1 · Published 2025-12-11

pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.

Technologies: [Pgadmin 4](https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4), [pgadmin4 (PyPI)](https://junglewise.ai/threats/technologies/pgadmin4). Vendors: [pgAdmin](https://junglewise.ai/threats/vendors/pgadmin), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-13780 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13780 being exploited in the wild.

**How severe is CVE-2025-13780?** Critical severity, with a CVSS score of 9.1, published 11 December 2025.

**Which products and versions are affected?** pgadmin4 (PyPI) ECOSYSTEM:introduced=0,fixed=9.11.

**Is there a fix for CVE-2025-13780?** Yes. pgadmin4 (PyPI): upgrade to 9.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-13780?** Check whether you run Pgadmin 4 or pgadmin4 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pgadmin4 (PyPI): upgrade to 9.11 or later

  ```sh
  pip install "pgadmin4>=9.11"
  ```


## Affected products

- Pgadmin 4
- pgadmin4 (PyPI) ECOSYSTEM:introduced=0,fixed=9.11

## Identifiers

- CVE-2025-13780
- GHSA-fxmw-jcgr-w44v
- PYSEC-2026-450

## Related threats

- [pgAdmin 4 session invalidation failure after password change](https://junglewise.ai/threats/cve-2026-116251-pgadmin-4-did-not-invalidate-a-user-s-existing-sessions-when)
- [pgAdmin 4 path traversal in server credentials](https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl)
- [pgAdmin 4 unauthorized server sharing to all users](https://junglewise.ai/threats/cve-2026-116248-in-pgadmin-4-server-mode-only-administrators-are-meant-to-share)
- [pgAdmin credential injection via libpq service file](https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the)
- [pgAdmin 4 Kerberos credential exposure authentication bypass](https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user)