CVE-2025-8714

Published Aug 14, 2025

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-8714 is an untrusted data inclusion vulnerability found in the pg_dump utility of PostgreSQL. It allows a malicious superuser on the origin server to inject arbitrary code that can be executed during the restoration of a database dump. This vulnerability affects pg_dump, pg_dumpall, and pg_restore when generating plain-format dumps. Successful exploitation could allow the malicious superuser to execute arbitrary code with the privileges of the client operating system account running psql during the dump restoration process. This could lead to system compromise, unauthorized access, data theft, or further system manipulation. The vulnerability affects versions of PostgreSQL prior to 17.6, 16.10, 15.14, 14.19, and 13.22.

Description: Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

f86ef6dc-4d3a-42ad-8f28-e6d5547a5007: CWE-829

Hype score: Not currently trending

References