The vulnerability allows a role with partman_user privileges to inject SQL into dynamic queries that use the time_dncoder text value of the writable part_config table. This injection can be executed when maintenance or background‑worker functions run, granting the attacker database‑wide control and, in the worst case, the ability to run operating‑system commands as the PostgreSQL service account. The flaw stems from improper quoting of the time_dncoder value in dynamic SQL, a classic SQL injection weakness (CWE‑89).

The issue affects the pg_partman extension for PostgreSQL (pgpartman) in all releases prior to 5.5.0. Any environment that uses the run_maintenance(), show_partitions(), show_partition_info(), undo_partition(), or partition_data_time() functions is vulnerable unless that extension is upgraded.

The CVSS base score of 8.5 indicates high severity. The EPSS score is not available, but no known public exploitation is listed in CISA's KEV catalog. Attackers can exploit the flaw from a role with partman_user privileges, and the injected SQL will run with the privileges of the background worker, which may be a PostgreSQL superuser. Successful exploitation could lead to database‑wide compromise and operating‑system command execution.