pgAdmin 4 versions prior to 9.10 on Windows systems contain a command injection vulnerability. This flaw arises from the use of shell=True in backup and restore operations, allowing attackers with high privileges to execute arbitrary system commands via crafted file paths. The vulnerability has a CVSS score of 6.8, indicating a medium severity level. A fix is available in version 9.10.