CVE-2025-59470

Critical · 9.0

CVSS

9.0

EPSS

1.5%

Published

Jan 8, 2026

CISA due date

—

The record

This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

Affected packages

Ecosystem	Package	Introduced	Fixed