Vulnerability · Published Aug 14, 2025 · Assigned by PostgreSQL

CVE-2025-8715PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server

High 8.8

In plain English

A high-severity security flaw in PostgreSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 58.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8pg_repack1.5.1-1.module_el8.10.0+3930+ecf33554ALSA-2025:14899
AlmaLinux:8pg_repack1.4.6-3.module_el8.6.0+2760+1746ec94ALSA-2025:15021
AlmaLinux:8pg_repack1.4.6-3.module_el8.6.0+3095+ee60d910ALSA-2025:15021
AlmaLinux:8pg_repack1.4.8-1.module_el8.9.0+3706+885c732eALSA-2025:15022
AlmaLinux:8pg_repack1.4.6-3.module_el8.9.0+3704+f1f917ceALSA-2025:15115
AlmaLinux:9pg_repack1.5.1-1.module_el9.6.0+146+c54fdecaALSA-2025:14827
AlmaLinux:9pg_repack1.4.8-2.module_el9.5.0+119+18833d03ALSA-2025:14862
AlmaLinux:8pgaudit1.4.0-7.module_el8.10.0+3889+48cb11fb.alma.1ALSA-2025:15115
AlmaLinux:8pgaudit1.5.0-1.module_el8.6.0+2760+1746ec94ALSA-2025:15021
AlmaLinux:8pgaudit1.5.0-1.module_el8.6.0+3095+ee60d910ALSA-2025:15021
AlmaLinux:8pgaudit1.7.0-1.module_el8.9.0+3706+885c732eALSA-2025:15022
AlmaLinux:8pgaudit1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1ALSA-2025:15115
AlmaLinux:8pgaudit16.0-1.module_el8.10.0+3798+606ebb9fALSA-2025:14899
AlmaLinux:9pgaudit16.0-1.module_el9.4.0+66+eb9878bcALSA-2025:14827
AlmaLinux:9pgaudit1.7.0-1.module_el9.3.0+52+21733919ALSA-2025:14862
AlmaLinux:9pgvector0.6.2-2.module_el9.6.0+167+4e561146ALSA-2025:14827
AlmaLinux:8postgres-decoderbufs2.4.0-1.Final.module_el8.10.0+3798+606ebb9fALSA-2025:14899
AlmaLinux:8postgres-decoderbufs0.10.0-2.module_el8.6.0+2760+1746ec94ALSA-2025:15021
AlmaLinux:8postgres-decoderbufs0.10.0-2.module_el8.6.0+3095+ee60d910ALSA-2025:15021
AlmaLinux:8postgres-decoderbufs1.9.7-1.Final.module_el8.9.0+3706+885c732eALSA-2025:15022
AlmaLinux:8postgres-decoderbufs0.10.0-2.module_el8.9.0+3704+f1f917ceALSA-2025:15115
AlmaLinux:9postgres-decoderbufs2.4.0-1.Final.module_el9.4.0+66+eb9878bcALSA-2025:14827
AlmaLinux:9postgres-decoderbufs1.9.7-1.Final.module_el9.3.0+52+21733919ALSA-2025:14862
AlmaLinux:8postgresql15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:8postgresql16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:8postgresql12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:9postgresql16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:9postgresql15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:9postgresql13.22-1.el9_6ALSA-2025:14878
AlmaLinux:8postgresql-contrib15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-contrib13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:8postgresql-contrib12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:8postgresql-contrib16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:9postgresql-contrib16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:9postgresql-contrib15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:9postgresql-contrib13.22-1.el9_6ALSA-2025:14878
AlmaLinux:8postgresql-docs16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:8postgresql-docs15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-docs12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:8postgresql-docs13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:9postgresql-docs16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:9postgresql-docs13.22-1.el9_6ALSA-2025:14878
AlmaLinux:9postgresql-docs15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:8postgresql-plperl12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:8postgresql-plperl13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:8postgresql-plperl15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-plperl16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:9postgresql-plperl16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:9postgresql-plperl15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:9postgresql-plperl13.22-1.el9_6ALSA-2025:14878
AlmaLinux:8postgresql-plpython312.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:8postgresql-plpython315.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-plpython316.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:8postgresql-plpython313.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:9postgresql-plpython316.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:9postgresql-plpython313.22-1.el9_6ALSA-2025:14878
AlmaLinux:9postgresql-plpython315.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:8postgresql-pltcl16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:8postgresql-pltcl12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:8postgresql-pltcl15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-pltcl13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:9postgresql-pltcl16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:9postgresql-pltcl15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:9postgresql-pltcl13.22-1.el9_6ALSA-2025:14878
AlmaLinux:8postgresql-private-devel15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-private-devel16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:9postgresql-private-devel16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:9postgresql-private-devel13.22-1.el9_6ALSA-2025:14878
AlmaLinux:9postgresql-private-devel15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:8postgresql-private-libs15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-private-libs16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:9postgresql-private-libs15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:9postgresql-private-libs13.22-1.el9_6ALSA-2025:14878
AlmaLinux:9postgresql-private-libs16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:8postgresql-server16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:8postgresql-server12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:8postgresql-server15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-server13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:9postgresql-server13.22-1.el9_6ALSA-2025:14878
AlmaLinux:9postgresql-server16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:9postgresql-server15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:8postgresql-server-devel15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-server-devel16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:8postgresql-server-devel12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:8postgresql-server-devel13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:9postgresql-server-devel13.22-1.el9_6ALSA-2025:14878
AlmaLinux:9postgresql-server-devel15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:9postgresql-server-devel16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:8postgresql-static16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:8postgresql-static15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-static13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:8postgresql-static12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:9postgresql-static15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:9postgresql-static13.22-1.el9_6ALSA-2025:14878
AlmaLinux:9postgresql-static16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:8postgresql-test16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:8postgresql-test13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:8postgresql-test15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-test12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:9postgresql-test16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:9postgresql-test15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:9postgresql-test13.22-1.el9_6ALSA-2025:14878
AlmaLinux:10postgresql-test-rpm-macros16.10-1.el10_0ALSA-2025:14826
AlmaLinux:8postgresql-test-rpm-macros13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:8postgresql-test-rpm-macros16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:8postgresql-test-rpm-macros15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-test-rpm-macros12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:9postgresql-test-rpm-macros15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:9postgresql-test-rpm-macros16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:9postgresql-test-rpm-macros13.22-1.el9_6ALSA-2025:14878
AlmaLinux:8postgresql-upgrade16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:8postgresql-upgrade15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:8postgresql-upgrade13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:8postgresql-upgrade12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:9postgresql-upgrade13.22-1.el9_6ALSA-2025:14878
AlmaLinux:9postgresql-upgrade15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
AlmaLinux:9postgresql-upgrade16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:8postgresql-upgrade-devel12.22-5.module_el8.10.0+4043+6cac3079ALSA-2025:15115
AlmaLinux:8postgresql-upgrade-devel16.10-1.module_el8.10.0+4038+0fbad93cALSA-2025:14899
AlmaLinux:8postgresql-upgrade-devel13.22-1.module_el8.10.0+4042+cb252986ALSA-2025:15021
AlmaLinux:8postgresql-upgrade-devel15.14-1.module_el8.10.0+4041+afd30bb4ALSA-2025:15022
AlmaLinux:9postgresql-upgrade-devel13.22-1.el9_6ALSA-2025:14878
AlmaLinux:9postgresql-upgrade-devel16.10-1.module_el9.6.0+174+80cb77f0ALSA-2025:14827
AlmaLinux:9postgresql-upgrade-devel15.14-1.module_el9.6.0+176+c508cfa2ALSA-2025:14862
Alpine:v3.20postgresql1515.14-r0ALPINE-CVE-2025-8715
Alpine:v3.21postgresql1515.17-r0ALPINE-CVE-2025-8715
Alpine:v3.22postgresql1515.14-r0ALPINE-CVE-2025-8715
Alpine:v3.20postgresql1616.10-r0ALPINE-CVE-2025-8715
Alpine:v3.21postgresql1616.10-r0ALPINE-CVE-2025-8715
Alpine:v3.22postgresql1616.10-r0ALPINE-CVE-2025-8715
Alpine:v3.23postgresql1616.10-r0ALPINE-CVE-2025-8715
Alpine:v3.24postgresql1616.10-r0ALPINE-CVE-2025-8715
Alpine:v3.21postgresql1717.6-r0ALPINE-CVE-2025-8715
Alpine:v3.22postgresql1717.6-r0ALPINE-CVE-2025-8715
Alpine:v3.23postgresql1717.6-r0ALPINE-CVE-2025-8715
Alpine:v3.24postgresql1717.6-r0ALPINE-CVE-2025-8715
Debian:12postgresql-1515.14-0+deb12u1DEBIAN-CVE-2025-8715
Debian:13postgresql-1717.6-0+deb13u1DEBIAN-CVE-2025-8715
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1594+4a6adae9RLSA-2025:15021
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.10.0+1862+29bef648RLSA-2025:15115
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1603+444d1b54RLSA-2025:15115
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.10.0+1622+bd25b19cRLSA-2025:15022
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.9.0+1525+fc91df60RLSA-2025:15022
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.10.0+1858+fcc46a79RLSA-2025:15022
Rocky Linux:8pg_repack0:1.5.1-1.module+el8.10.0+1900+d7340343RLSA-2025:14899
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1594+4a6adae9RLSA-2025:15115
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1603+444d1b54RLSA-2025:15021
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.10.0+1862+29bef648RLSA-2025:15021
Rocky Linux:9pg_repack0:1.4.8-2.module+el9.5.0+30637+4391fccaRLSA-2025:14862
Rocky Linux:9pg_repack0:1.5.1-1.module+el9.5.0+30638+72f697e1RLSA-2025:14827
Rocky Linux:8pgaudit0:16.0-1.module+el8.10.0+1622+bd25b19cRLSA-2025:14899
Rocky Linux:8pgaudit0:1.5.0-1.module+el8.9.0+1594+4a6adae9RLSA-2025:15021
Rocky Linux:8pgaudit0:1.4.0-7.module+el8.9.0+1735+a332307bRLSA-2025:15115
Rocky Linux:8pgaudit0:16.0-1.module+el8.10.0+1858+fcc46a79RLSA-2025:14899
Rocky Linux:8pgaudit0:1.7.0-1.module+el8.9.0+1525+fc91df60RLSA-2025:15022
Rocky Linux:9pgaudit0:1.7.0-1.module+el9.5.0+30637+4391fccaRLSA-2025:14862
Rocky Linux:9pgaudit0:16.0-1.module+el9.5.0+30638+72f697e1RLSA-2025:14827
Rocky Linux:8postgres-decoderbufs0:2.4.0-1.Final.module+el8.10.0+1858+fcc46a79RLSA-2025:14899
Rocky Linux:8postgres-decoderbufs0:2.4.0-1.Final.module+el8.10.0+1622+bd25b19cRLSA-2025:14899
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.9.0+1603+444d1b54RLSA-2025:15115
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.9.0+1603+444d1b54RLSA-2025:15021
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.10.0+1862+29bef648RLSA-2025:15021
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.9.0+1594+4a6adae9RLSA-2025:15021
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.9.0+1594+4a6adae9RLSA-2025:15115
Rocky Linux:8postgres-decoderbufs0:0.10.0-2.module+el8.10.0+1862+29bef648RLSA-2025:15115
Rocky Linux:8postgres-decoderbufs0:1.9.7-1.Final.module+el8.9.0+1525+fc91df60RLSA-2025:15022
Rocky Linux:9postgres-decoderbufs0:1.9.7-1.Final.module+el9.5.0+30637+4391fccaRLSA-2025:14862
Rocky Linux:9postgres-decoderbufs0:2.4.0-1.Final.module+el9.5.0+30638+72f697e1RLSA-2025:14827
Rocky Linux:8postgresql0:15.14-1.module+el8.10.0+2060+489fc2c4RLSA-2025:15022
Rocky Linux:8postgresql0:13.22-1.module+el8.10.0+2059+b61e6896RLSA-2025:15021
Rocky Linux:8postgresql0:16.10-1.module+el8.10.0+2056+3327f2bcRLSA-2025:14899
Rocky Linux:8postgresql0:12.22-5.module+el8.10.0+2058+57631455RLSA-2025:15115
Rocky Linux:9postgresql0:13.22-1.el9_6RLSA-2025:14878
Rocky Linux:10postgresql160:16.10-1.el10_0RLSA-2025:14826
Ubuntu:22.04:LTSpostgresql-1414.19-0ubuntu0.22.04.1USN-7741-1
Ubuntu:22.04:LTSpostgresql-1414.19-0ubuntu0.22.04.1UBUNTU-CVE-2025-8715
Ubuntu:24.04:LTSpostgresql-1616.10-0ubuntu0.24.04.1UBUNTU-CVE-2025-8715
Ubuntu:24.04:LTSpostgresql-1616.10-0ubuntu0.24.04.1USN-7741-1
Ubuntu:25.10postgresql-1717.6-1UBUNTU-CVE-2025-8715

Affected products (as reported)

VendorProductVersions
n/a PostgreSQL 17 – before 17.616 – before 16.1015 – before 15.1414 – before 14.1911.20 – before 13.22

Weakness: CWE-93 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References