Introduction
Attackers with access to a PostgreSQL origin server can embed malicious commands in database object names. When a dump from that server is restored, those commands run on the client system. The flaw sits in routine backup and migration workflows, and it exposes both the database and the operating system to compromise.
PostgreSQL is a leading open source relational database system, used by enterprises, governments, and startups worldwide. Its broad feature set and reliability have made it the backbone of a lot of critical data infrastructure.
Technical Information
CVE-2025-8715 is a critical vulnerability in PostgreSQL's backup and migration utilities (pg_dump, pg_dumpall, pg_restore, pg_upgrade). The cause is improper neutralization of newline (CRLF) characters in database object names. An attacker with privileges to create or alter objects can craft names that contain newline sequences followed by psql meta-commands (such as \! for shell execution).
pg_dump and the related tools write these object names verbatim into the dump file when they export the database. If someone later restores the dump with psql, the psql client interprets the embedded meta-commands as commands and runs them with the privileges of the user running the restore. That gives the attacker arbitrary code execution on the client machine. An attacker can instead inject SQL statements that run as a superuser on the target database during the restore.
The vulnerability is classified as CWE-93 (improper neutralization of CRLF sequences). It is a regression of CVE-2012-0868, whose fix had addressed similar issues. The bug came back in PostgreSQL version 11.20 and remained in every later version until the fixed releases.
Affected Systems and Versions
- PostgreSQL pg_dump, pg_dumpall, pg_restore, pg_upgrade
- Affected versions: 11.20 up to (but not including) 17.6, 16.10, 15.14, 14.19, 13.22
- Versions before 11.20 are not affected
Vendor Security History
PostgreSQL has a strong track record of responding to security issues, and the team typically issues timely patches and advisories for critical vulnerabilities. This one, though, is a direct regression of CVE-2012-0868, which was fixed over a decade ago. A bug class returning like this shows how hard it is to keep security controls in place across several long-lived branches of a codebase that keeps changing.
