When Regex Isn’t Enough: How We Discovered CVE-2025-13780 in pgAdmin

Researchers identified a vulnerability in pgAdmin 4's plain-text restore feature, specifically CVE-2025-13780, which allowed attackers to bypass regex-based filters and execute shell commands on the host. The vulnerability stemmed from the inadequate regex checks that failed to account for variations in whitespace and line boundaries recognized by psql, allowing crafted payloads to go undetected. The issue was a result of discrepancies between the regex's interpretation of SQL meta-commands and psql's handling of them, highlighting the limitations of using regex for security purposes. In response, pgAdmin 4 version 9.11 introduced a more robust solution by implementing the \restrict option during restores, which directly constrains the execution of dangerous commands within psql rather than relying on pre-execution filters. This change shifts the security responsibility to the component executing the commands, ensuring better alignment with psql's grammar and reducing the risk of similar exploits in the future.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.