CVE Catalog
CVE-2025-59470
CriticalSummary
This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.
Risk Assessment
The risk includes the possibility of remote code execution with postgres user privileges, which can lead to database integrity compromise, data theft, or privilege escalation.
Recommendation
It is recommended to restrict backup operator privileges and implement input validation for interval and order parameters.
Original NVD description (English source)
This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.