CVE-2025-2945: Critical Remote Code Execution Vulnerability in pgAdmin 4

Overview

CVE-2025-2945 is a critical remote code execution (RCE) vulnerability discovered in pgAdmin 4, a widely used open-source administration and management tool for PostgreSQL databases. This vulnerability allows authenticated attackers to execute arbitrary Python code on the server hosting pgAdmin 4, potentially leading to full system compromise.​

The issue arises from the improper handling of user-supplied input in specific application components, where untrusted data is passed directly to Python’s eval() function without adequate validation.

Vulnerability Summary

Affected Products

How the Exploit Works

The vulnerability exists in two POST endpoints within pgAdmin 4:​

1. /sqleditor/query_tool/download: The query_commited parameter is directly passed to Python’s eval() function without proper sanitization.​

2. /cloud/deploy: Similarly, the high_availability parameter is unsafely evaluated using eval().​

By crafting malicious input for these parameters, an authenticated attacker can execute arbitrary Python code on the server.​

Conceptual Code Example

An attacker could exploit the vulnerability by sending a crafted POST request to the vulnerable endpoint.​

Example in Python:

In this example, the attacker leverages Python’s __import__ function to execute the whoami command</a> on the server.</span>​</p>

<ul data-start="2250" data-end="2690">
<li class="" data-start="2250" data-end="2359">
<p class="" data-start="2252" data-end="2359"><strong data-start="2252" data-end="2272">Update pgAdmin 4</strong>: <span class="relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out">Upgrade to version <strong data-start="19" data-end="26">9.2</strong> or later, where the vulnerability has been addressed.</span></p>
</li>
<li class="" data-start="2361" data-end="2469">
<p class="" data-start="2363" data-end="2469"><strong data-start="2363" data-end="2382">Restrict Access</strong>: <span class="relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out">Limit <a href="https://www.ameeba.com/blog/fortinet-s-fortigate-vulnerability-ssl-vpn-symlink-exploit-puts-user-access-at-risk-post-patching/" data-wpil-monitor-id="30406">access to pgAdmin 4 to trusted networks and users</a>.</span>​</p>
</li>
<li class="" data-start="2471" data-end="2580">
<p class="" data-start="2473" data-end="2580"><strong data-start="2473" data-end="2493">Input Validation</strong>: <span class="relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out">Ensure that all user inputs are properly validated and sanitized before processing.</span>​</p>
</li>
<li class="" data-start="2582" data-end="2690">
<p class="" data-start="2584" data-end="2690"><strong data-start="2584" data-end="2603">Monitor Systems</strong>: <span class="relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out">Implement monitoring to detect any unusual activities that may indicate exploitation attempts.</span>​</p>
</li>
</ul>
<h2 class="" data-start="2697" data-end="2721">Timeline and Response</h2>
<ul data-start="2723" data-end="3046">
<li class="" data-start="2723" data-end="2824">
<p class="" data-start="2725" data-end="2824"><strong data-start="2725" data-end="2737">Reported</strong>: <span class="relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out">March 29, 2025</span>​</p>
</li>
<li class="" data-start="2826" data-end="2934">
<p class="" data-start="2828" data-end="2934"><strong data-start="2828" data-end="2847">Patched Release</strong>: <span class="relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out">April 4, 2025 (pgAdmin 4 version 9.2)</span>​</p>
</li>
<li class="" data-start="2936" data-end="3046">
<p class="" data-start="2938" data-end="3046"><strong data-start="2938" data-end="2959">Public Disclosure</strong>: <span class="relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out">April 7, 2025</span>​</p>
</li>
</ul>
<h2 class="" data-start="3053" data-end="3072">Closing Thoughts</h2>
<p class="" data-start="3074" data-end="3239"><span class="relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out">CVE-2025-2945 highlights the critical importance of proper input handling and validation in <a class="wpil_keyword_link" title="web" href="http://pseudopod.ameeba.com" data-wpil-keyword-link="linked" data-wpil-monitor-id="29353">web</a> applications.</span> <span class="relative -mx-px my-[-0.2rem] rounded px-px py-[0.2rem] transition-colors duration-100 ease-in-out">The use of functions like <code data-start="26" data-end="34">eval() with untrusted input can lead to severe security vulnerabilities. Organizations using pgAdmin 4 should promptly update to the latest version and review their security practices to prevent similar issues.