# CVE-2025-8715

## Summary

- **CVE ID:** CVE-2025-8715
- **Severity:** HIGH
- **CVSS Score:** 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **CWE:** CWE-93
- **Published:** Aug 14, 2025
- **Last Modified:** Mar 12, 2026

## Description

Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name.  The same attacks can achieve SQL injection as a superuser of the restore target server.  pg_dumpall, pg_restore, and pg_upgrade are also affected.  Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.  Versions before 11.20 are unaffected.  CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.

## Affected Products

- n/a — PostgreSQL (17)
- n/a — PostgreSQL (16)
- n/a — PostgreSQL (15)
- n/a — PostgreSQL (14)
- n/a — PostgreSQL (11.20)

## References

- [CNA](https://www.postgresql.org/support/security/CVE-2025-8715/)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.41%
- **EPSS Percentile:** 34.7

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._