CVE-2025-8714

A flaw was found in PostgreSQL. This vulnerability allows a malicious superuser on a PostgreSQL server to inject arbitrary code into dump files created by pg_dump, pg_dumpall, and pg_restore, causing arbitrary code execution on the client machine when these dump files are restored by psql due to untrusted data inclusion.

To exploit this flaw, a PostgreSQL user with special privileges needs to inject arbitrary code in a dump file. The malicious code will only be executed on the client machine when a user restore the crafted dump file. Due to these reasons, this vulnerability has been rated with an Important severity.

Additionally, pg_restore is affected only when used to generate a plain-format dump.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not restore a dump file from a server or user you do not explicitly trust.