Description

Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-13T13:17:48.127Z",
  "pubdate": "2026-08-13T13:17:48.127Z",
  "executiveSummary": "An untrusted data inclusion vulnerability exists in PostgreSQL utilities including pg_dump, pg_dumpall, and pg_restore when generating plain-format dumps. This vulnerability allows a malicious superuser of an origin database server to inject arbitrary code for restore-time execution as the client operating system account running psql. The flaw stems from an insufficient mitigation previously introduced for CVE-2025-8714, where the newly implemented \\restrict and \\unrestrict meta-commands were intended to block input expansion attacks, but the \\unrestrict command itself remained sufficient to facilitate the attack vector. The risk implications are severe, as an attacker controlling a compromised or malicious origin server can achieve arbitrary code execution on client machines initiating a database restoration process. Exploitation requires a privileged database superuser on the origin server and user interaction in the form of a client restoring the malicious database dump using psql. Affected software includes PostgreSQL versions prior to 18.5, 17.11, 16.15, 15.19, and 14.24.",
  "technicalDetails": "The vulnerability resides within the pg_dump, pg_dumpall, and pg_restore utilities of PostgreSQL, specifically involving how plain-format database dumps handle metadata and command input expansion during restoration via psql. The root cause is rooted in inadequate design within the psql meta-command parsing logic introduced to patch CVE-2025-8714. Specifically, the fix implemented the \\restrict and \\unrestrict meta-commands to sandbox and block malicious input expansion vectors. However, the \\unrestrict mechanism itself was found to be improperly bounded or misused, allowing malicious input to bypass the intended security restrictions.\nThe exploitation method leverages a malicious PostgreSQL superuser on an origin server who crafts a specially formulated database dump. When a client operating system account executes psql to restore this dump, the embedded sequence containing the flaw triggers input expansion. Because \\unrestrict can be invoked within the stream, it effectively neutralizes the security controls of \\restrict, enabling the execution of arbitrary operating system commands.\nThe step-by-step attack flow begins with a compromised or malicious PostgreSQL origin server controlled by an attacker possessing database superuser privileges. The attacker constructs a database dump using pg_dump, pg_dumpall, or pg_restore (in plain-format mode) containing malicious payloads leveraging the \\unrestrict meta-command sequence. A victim user or automated system initiates a restore operation on this dump using the psql client. As psql processes the input stream, the meta-command evaluation fails to safely restrict input expansion due to the flaw in how \\unrestrict handles restrictions. The injected arbitrary code is subsequently evaluated and executed in the security context of the client operating system account running the psql restoration process.\nAffected components include the pg_dump, pg_dumpall, and plain-format pg_restore utilities alongside the psql meta-command parser. The affected versions are PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24. Authentication requirements involve database superuser privileges on the origin server to generate the malicious dump. Privilege requirements on the client side depend on the permissions of the operating system account executing psql, leading to potential privilege escalation or code execution under that user's security context. Network exposure is indirect, relying on the transfer and subsequent restoration of an untrusted database dump file."
}