A critical remote code execution vulnerability in pgAdmin 4 allows authenticated attackers to execute arbitrary commands on the host server, posing a severe threat to system and data integrity.

This is a remote code execution vulnerability triggered during the restoration of PLAIN-format dump files while running in server mode. The vulnerability requires the attacker to have low-level privileges (authenticated) to initiate the restore process.

Successful exploitation allows an attacker to gain full control over the server hosting pgAdmin, potentially leading to unauthorized data access, lateral movement within the network, and complete system compromise. Given the high CVSS score of 9.1, this vulnerability represents a critical business risk that could result in significant operational disruption and data loss.

Immediate Action: Update pgAdmin 4 to version 9.11 or later to remediate the vulnerability.

Proactive Monitoring: Review database access logs and server activity for any unauthorized or unusual restore operations involving PLAIN-format dump files.

Compensating Controls: Restrict access to the pgAdmin server interface to trusted internal networks and implement strict role-based access control to limit who can perform database restoration tasks.

Public Exploit Available: Yes, multiple public proofs-of-concept exist on GitHub.

The severity of this vulnerability, combined with the availability of public proof-of-concept code, necessitates immediate action. Administrators must prioritize updating pgAdmin 4 to version 9.11 or higher across all environments to eliminate the risk of remote code execution. Failure to patch may expose the underlying database server to total compromise.