A flaw in TimescaleDB between versions 2.23.0 and 2.25.1 allows a PostgreSQL user who has write access to a schema that appears in the database’s search_path to create a function with the same name as a built‑in PostgreSQL function. During an extension upgrade the server will resolve the function from the user‑writable schema instead of the intended PostgreSQL implementation, enabling the attacker to execute arbitrary code on the database host. This translates to a high‑severity vulnerability classified as CWE‑426 and CWE‑427. The impact is a complete compromise of the database system on the host where the database process runs.

The affected product is TimescaleDB, a PostgreSQL extension for time‑series data. All installed instances of TimescaleDB from version 2.23.0 up through 2.25.1 are vulnerable. The vendor responsible for the fix is Timescale, and the fix is incorporated in release 2.25.2.

The vulnerability carries a CVSS score of 8.8, indicating high severity, while the EPSS score is less than 1%, suggesting a low probability of active exploitation at present. The flaw has not been listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector involves a user or application with database permissions leveraging a writable schema in the search_path; the attacker must already have database access to create the malicious function, after which the code runs with the privileges of the database server process during an upgrade. The risk is mitigated by applying the published patch, but if immediate upgrade is not feasible, deanonymizing or dropping the conflicting functions and tightening the search_path before upgrade can provide a temporary safeguard.