Improper Neutralization of Newlines Vulnerability in PostgreSQL
CVE-2025-8715

8.8HIGH

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
14 August 2025

What is CVE-2025-8715?

This vulnerability arises from an improper neutralization of newlines in the pg_dump utility of PostgreSQL. An attacker can leverage this flaw to execute arbitrary code during the restoration process, using the client operating system account that runs the psql command for restoring dumps. Additionally, the vulnerability may lead to SQL injection attacks, particularly for superusers on the target server during the restore operation. Notably, the issues affect not only pg_dump but also pg_dumpall, pg_restore, and pg_upgrade. This problem was reintroduced in PostgreSQL 11.20, following previous assurances of mitigation in CVE-2012-0868.

Affected Version(s)

PostgreSQL 17 < 17.6

PostgreSQL 16 < 16.10

PostgreSQL 15 < 15.14

References

https://www.postgresql.org/support/security/CVE-2025-8715/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Noah Misch for reporting this problem.
.