ProxmoxSecurityAdvisory's latest activity
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00079-1: Missing shell quoting for ceph install command options Advisory date: 2026-10-30 Packages: pve-manager Details: Missing shell quoting for parameters passed to termproxy while handling xtermjs API requests allowed an... -
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00078-1: XSS in consent-text datacenter option Advisory date: 2026-10-30 Packages: pve-manager, libpve-cluster-perl Details: An incomplete definition of the consent-text field in the datacenter configuration schema allowed a...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00077-1: Missing validation of network configuration fields Advisory date: 2026-10-30 Packages: libpve-common-perl, pve-manager Details: Some fields/options in the network configuration /etc/network/interfaces which are...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00076-1: Missing enforcement of pool ACL when querying pool information Advisory date: 2026-10-30 Packages: pve-manager Details: It was possible to query information about a specific pool without the required Pool.Audit...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00075-1: Missing validation of xterm.js URL parameters Advisory date: 2026-10-30 Packages: pve-xtermjs Details: Missing validation of URL parameters in the xterm.js console page allows an attacker to trigger almost arbitrary...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00074-1: QEMU HMP: incomplete permissions checks for gpa2hpa/gpa2hva/i commands Advisory date: 2026-10-19 Packages: qemu-server Details: The gpa2hpa/gpa2hva/i of QEMU's HMP interface were only requiring Sys.Modify...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00073-1: pvedaemon denial-of-service via QEMU guest agent file-read command Advisory date: 2026-10-19 Packages: qemu-server Details: Insufficient hardening of the QEMU guest agent file-read handling allowed a malicious guest...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00072-1: Missing buffer limits when processing Qemu guest agent responses Advisory date: 2026-10-19 Packages: qemu-server Details: An attacker with access to a VM with configured guest agent can consume excessive memory...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00071-1: Incomplete privilege checks for cloudinit config changes Advisory date: 2026-10-19 Packages: qemu-server Details: An attacker with VM.Config.Network privileges on a VM could change cloud-init settings relating to...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00070-1: Missing storage access check when configuring custom cloud-init snippets for a VM Advisory date: 2026-10-19 Packages: qemu-server Details: A user with the VM.Config.Cloudinit privilege could reference volumes from...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00069-1: Missing redaction of cloudinit cipassword in snapshot config endpoint Advisory date: 2026-10-19 Packages: qemu-server Details: The VM-related endpoint /snapshot/{snap}/config for querying the configuration of a...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00068-1: "PwnEscape" Guest-to-Host KVM Escape Advisory date: 2026-10-16 Packages: proxmox-kernel Details: Incomplete validation of network packet checksum metadata when completing the checksum calculation allowed an attacker...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00067-1: VMA extraction path escape Advisory date: 2026-10-15 Packages: pve-qemu-kvm Details: An attacker restoring a crafted VMA file could trigger overwrites of arbitrary host paths. Note: writing "raw" VMA files is not...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00066-1: ESXi importer: path traversal in vmx parser Advisory date: 2026-10-12 Packages: libpve-storage-perl Details: Incomplete path validation in the ESXi importer allowed an attacker with access to a configured ESXi...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Mail Gateway - Security Advisories.Subject: PSA-2026-00065-1: PMG: Bypass DMARC check by spoofed envelope sender header Advisory date: 2026-10-07 Packages: pmg-api Details: Adding a X-Proxmox-Envelope-From header to a mail confuses pmg-smtp-filter into using the mail-address...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Mail Gateway - Security Advisories.Subject: PSA-2026-00064-1: PMG: Administrator to root privilege escalation via private keys in backup Advisory date: 2026-10-07 Packages: pmg-api Details: A user with Administrator role could create and download a backup, which includes the...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Mail Gateway - Security Advisories.Subject: PSA-2026-00063-1: PMG: Administrator to root privilege escalation via http_proxy configuration setting Advisory date: 2026-10-07 Packages: pmg-api Details: Insufficient input validation for the http_proxy configuration setting...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Backup Server - Security Advisories.Subject: PSA-2026-00062-1: Missing privilege checks when configuring scheduled tape backup jobs Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: A user with sufficient privileges to set up a tape backup job could reference...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Backup Server - Security Advisories.Subject: PSA-2026-00061-1: Missing validation of chunk sizes during pull sync Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: An attacker with control over a pull source (or its raw index contents) could trick the pull...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Backup Server - Security Advisories.Subject: PSA-2026-00060-1: Missing privilege checks when removing namespace from prune job Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: The required privileges were not checked correctly when removing the configured...