Report feedback

Due to insecure handling of untrusted data in pg_dump in PostgreSQL, an unauthenticated remote attacker who is a superuser of the source server can inject arbitrary code and have it executed during restore under the account of the system performing the psql restore [1].

The vulnerability is present in product:

• PostgreSQL; >=17.0, <17.6; >=16.0, <16.10; >=15.0, <15.14; >=14.0, <14.19; >=13.0, <13.22

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

• CVE-2025-8714 at cve.org, NVD
• CWE-829: Inclusion of Functionality from Untrusted Control Sphere at cwe.mitre.org

The vulnerability was publicly disclosed 14. 8. 2025.

Due to improper neutralization of newline characters in pg_dump in PostgreSQL, an unauthenticated remote attacker can inject arbitrary code and have it executed during restore under the account of the system performing the psql restore, or alternatively perform SQL injection as a superuser of the target server [1].

The vulnerability is present in product:

• PostgreSQL; >=17.0, <17.6; >=16.0, <16.10; >=15.0, <15.14; >=14.0, <14.19; >=13.0, <13.22

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

• CVE-2025-8715 at cve.org, NVD
• CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 14. 8. 2025.

Due to insufficient protection of optimizer statistics in PostgreSQL, an authenticated remote attacker can read sampled data even from tables protected by access privileges or row-level security policies [1].

The vulnerability is present in product:

• PostgreSQL; >=17.0, <17.6; >=16.0, <16.10; >=15.0, <15.14; >=14.0, <14.19; >=13.0, <13.22

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

More information:

• CVE-2025-8713 at cve.org, NVD
• CWE-1230: Exposure of Sensitive Information Through Metadata at cwe.mitre.org

The vulnerability was publicly disclosed 14. 8. 2025.