What’s Vulnerable › Vulnerabilities

CVE-2025-0218: pgAgent scheduled batch job scripts are created in a predictable temporary directory potentially allowing a denial of service

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-07 · updated 2026-06-17
• Weakness: CWE-340

Description

When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random number generator is used when generating the directory name, leading to the possibility for a local attacker to pre-create the directory and thus prevent pgAgent from executing jobs, disrupting scheduled tasks.

Affected products

• pgAgent: before 4.2.3 — fixed in 4.2.3

How to fix

Upgrade to a fixed version: pgAgent 4.2.3. Check the vendor advisory for mitigations.

References

• https://github.com/pgadmin-org/pgagent/commit/1ecd193a2be3a3dc9e98f369495e1a792e6d508c
• https://lists.debian.org/debian-lts-announce/2025/10/msg00018.html

Get alerted when CVE-2025-0218 or the next vulnerability affects your stack