Introduction
Database administrators restoring backups from trusted sources may unknowingly run attacker-supplied code with the full operating system privileges of the account doing the restore. CVE-2025-8714 is a critical flaw in PostgreSQL's backup and restore utilities. It affects a wide range of supported versions and may reach production, cloud, and managed database environments.
PostgreSQL is one of the most widely used open-source relational database management systems, running applications for enterprises, cloud providers, and critical infrastructure. Its backup and restore utilities (pg_dump, pg_dumpall, pg_restore) are essential to disaster recovery and migration, so a flaw in them can have far-reaching operational and security consequences.
Technical Information
CVE-2025-8714 comes from how pg_dump and related utilities include data from the origin database. A PostgreSQL superuser on the source system can create or modify database objects (such as tables, comments, or functions) so that they contain psql meta-commands. psql interprets these meta-commands, which may be prefixed with a backslash or an exclamation mark, during the restore. The exclamation mark meta-command, for example, executes shell commands. If such commands are embedded in the dump file, they run as the operating system user performing the restore.
The vulnerability affects the following utilities:
- pg_dump
- pg_dumpall
- pg_restore (when used to generate plain-format dumps)
The root cause is that these utilities do not sufficiently sanitize or validate database content before writing it into the dump file, which makes this a classic case of CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). MySQL had a similar issue in CVE-2024-21096, where crafted database content allowed shell commands to be injected through mysqldump.
No public code snippets or proof of concept are available at this time. The attack requires superuser privileges on the origin PostgreSQL instance.
Affected Systems and Versions
The following PostgreSQL versions are affected:
- All versions before 17.6
- All versions before 16.10
- All versions before 15.14
- All versions before 14.19
- All versions before 13.22
Any system using pg_dump, pg_dumpall, or pg_restore (plain-format) from these versions is vulnerable. Exploitation also requires that a malicious superuser controls the origin server.
Vendor Security History
PostgreSQL has had several notable vulnerabilities in its backup and restore utilities:
- CVE-2025-1094: SQL injection in psql through improper UTF-8 handling, which allows meta-command injection.
- CVE-2024-7348: TOCTOU race condition in pg_dump that allows arbitrary SQL function execution during backup.
The PostgreSQL Global Development Group typically provides timely patches and detailed advisories. Even so, backup-related vulnerabilities keep recurring, which points to the need for ongoing architectural review and security testing.
