CVE-2025-8715

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 17.6 PostgreSQL versions prior to 16.10 PostgreSQL versions prior to 15.14 PostgreSQL versions prior to 14.19 PostgreSQL versions prior to 13.22

Description: Improper neutralization of newlines in pg dump allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg dumpall, pg restore, and pg upgrade are also affected.

Recommendations: Update to PostgreSQL version 17.6 or later. Update to PostgreSQL version 16.10 or later. Update to PostgreSQL version 15.14 or later. Update to PostgreSQL version 14.19 or later. Update to PostgreSQL version 13.22 or later.