CVE-2025-8715
Description
Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.
How to fix
- PostgreSQL17.6, 16.10, 15.14, 14.19, 13.22 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| PostgreSQL | 17 ≤ v < 17.6, 16 ≤ v < 16.10, 15 ≤ v < 15.14, 14 ≤ v < 14.19, 11.20 ≤ v < 13.22 | 17.6, 16.10, 15.14, 14.19, 13.22 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.