CVE-2025-8714 in PostgreSQL
Summary
by MITRE • 08/14/2025
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/01/2025
This vulnerability in PostgreSQL represents a critical code injection flaw that exploits the trust model between database dump and restore operations. The issue stems from pg_dump's handling of untrusted data during the dump process, specifically when the dump contains meta-commands that are executed during restore time. When a malicious superuser creates a dump containing specially crafted psql meta-commands, these commands can be executed with the privileges of the operating system account running psql during restore operations. This creates a privilege escalation vector where database-level privileges can be leveraged to execute arbitrary code on the underlying operating system, effectively bypassing traditional database security boundaries. The vulnerability affects multiple PostgreSQL versions including 13 through 17, with specific patch levels required for remediation.
The technical implementation of this vulnerability relies on the fact that pg_dump and pg_dumpall can include meta-commands in their output that are designed to be executed by psql during restore operations. These meta-commands are typically used for administrative tasks such as setting session variables, connecting to other databases, or executing custom SQL statements. When a malicious superuser places specially crafted meta-commands within the dump file, these commands are executed during the restore process by the psql client running with the privileges of the operating system user. This is particularly dangerous because the restore process typically runs with elevated privileges to ensure proper database restoration, but the malicious commands can leverage this to execute arbitrary code on the target system. The vulnerability is classified as a code injection issue that maps to CWE-94, which describes the weakness of allowing code to be injected and executed.
The operational impact of this vulnerability extends far beyond simple data compromise, as it enables full system compromise through database administrative functions. Attackers with superuser privileges on a PostgreSQL database can create malicious dumps that, when restored, execute arbitrary commands on the target system, potentially leading to complete system compromise. The attack vector is particularly insidious because it requires minimal privileges to execute - only a superuser account on the database server is needed to create the malicious dump. During restore operations, the commands execute with the privileges of the psql client process, which typically runs with elevated system privileges to ensure proper database restoration. This vulnerability can be exploited to establish persistent backdoors, escalate privileges, or perform data exfiltration from the underlying operating system. The similarity to MySQL CVE-2024-21096 indicates that this is a common pattern in database management systems where dump and restore operations create trust relationships that can be exploited for code execution.
The mitigation strategies for this vulnerability involve both immediate patching and operational hardening measures. Organizations should immediately upgrade to PostgreSQL versions 17.6, 16.10, 15.14, 14.19, or 13.22, which contain the necessary fixes to prevent untrusted data inclusion in dump files. Additionally, administrators should implement strict access controls for database superuser accounts, ensuring that only trusted personnel have these privileges. The principle of least privilege should be enforced for database dump and restore operations, limiting the scope of commands that can be executed during restore processes. Organizations should also consider implementing network segmentation and monitoring for suspicious database dump file creation and restore activities. From an ATT&CK perspective, this vulnerability maps to T1059.001 (Command and Scripting Interpreter: PowerShell) and T1078 (Valid Accounts) as it leverages legitimate database administrative tools to execute malicious code. Regular security audits of database dump files and restore operations should be conducted to detect potential exploitation attempts, and organizations should implement logging and monitoring solutions that can detect unauthorized dump file creation and restore operations.