ProxmoxSecurityAdvisory's latest activity
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00059-1: pxar/container restore target rootfs escape Advisory date: 2026-10-07 Packages: pve-container, proxmox-backup-client, rust-pxar Details: An attacker with direct access to a PBS datastore configured as storage on a... -
ProxmoxSecurityAdvisory replied to the thread Proxmox Backup Server - Security Advisories.Subject: PSA-2026-00059-1: pxar/container restore target rootfs escape Advisory date: 2026-10-07 Packages: pve-container, proxmox-backup-client, rust-pxar Details: An attacker with direct access to a PBS datastore configured as storage on a...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Backup Server - Security Advisories.Subject: PSA-2026-00058-1: S3-Refresh path escape issue Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: Incomplete validation of an S3 object key returned by a configured S3 endpoint allowed an attacker with control over...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Backup Server - Security Advisories.Subject: PSA-2026-00057-1: Missing privilege checks for local sync jobs Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: An attacker with highly privileged access to one datastore + namespace could set up a "local" sync job...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Backup Server - Security Advisories.Subject: PSA-2026-00056-1: Missing privilege checks in GC status API Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: Missing privilege checks in the GC status API endpoint at /api2/json/admin/gc/{store} allowed an...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Backup Server - Security Advisories.Subject: PSA-2026-00055-1: Incomplete validation of sync encryption/decryption key access Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: An attacker with Datastore.Modify or Datastore.Read on a datastore + namespace can...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Backup Server - Security Advisories.Subject: PSA-2026-00054-1: Out-of-bounds read when processing malformed fixed-size index file Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: Missing overflow checks when handling the index and chunk size of a fixed-size...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00053-1: PBS backup access includes host/NNN groups Advisory date: 2026-10-01 Packages: libpve-storage-perl Details: If a configured PBS storage contained backup groups with type host, but numerical backup IDs, such...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00052-1: Command injection via import of malicious OVA file Advisory date: 2026-10-01 Packages: libpve-storage-perl, qemu-server Details: Insufficient restrictions of OVA member file names allowed an attacker with sufficient...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Backup Server - Security Advisories.Subject: PSA-2026-00051-1: integrity bypass of encrypted backups on an untrusted PBS instance Advisory date: 2026-09-24 Packages: proxmox-backup-client, proxmox-backup-file-restore, libproxmox-backup-qemu0 Details: When a PBS client is...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00051-1: integrity bypass of encrypted backups on an untrusted PBS instance Advisory date: 2026-09-24 Packages: proxmox-backup-client, proxmox-backup-file-restore, libproxmox-backup-qemu0 Details: When a PBS client is...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00050-1: password change via incomplete username validation Advisory date: 2026-09-21 Packages: pve-access-control Details: An attacker with sufficient privileges to create new PAM user entries (Realm.AllocateUser on...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Mail Gateway - Security Advisories.Subject: PSA-2026-00049-1: PMG: Bypass of mail filters by crafted boundary parameters Advisory date: 2026-09-21 Packages: pmg-api, libmime-tools-perl Details: Certain problematic strings used as Content-Type boundaries were not covered by the...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Mail Gateway - Security Advisories.Subject: PSA-2026-00048-1: PMG: XSS in filename display in attachment quarantine Advisory date: 2026-09-21 Packages: pmg-gui Details: The filename field in the AttachementGrid component shown in the Attachment Quarantine view takes its data...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00047-1: newline injection into firewall config files Advisory date: 2026-09-21 Packages: pve-firewall, proxmox-firewall Details: Incomplete validation of API parameters allowed the injection of newlines or invalid lines...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00046-1: Privilege escalation through malicious OCI container image Advisory date: 2026-09-10 Packages: pve-container Details: The check for control characters in the configuration keys of OCI container images was too...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Backup Server - Security Advisories.Subject: PSA-2026-00045-1: ACME directory ToS URL XSS Advisory date: 2026-09-10 Packages: proxmox-backup, proxmox-widget-toolkit Details: The terms of service URL returned by an ACME directory was not escaped properly when displaying it on...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00044-1: XSS in various UI components Advisory date: 2026-09-10 Packages: pve-manager...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00043-1: Authentication bypass in EOL Proxmox VE 7 release Advisory date: 2026-09-01 Packages: libpve-access-control Affected: libpve-access-control >= 7.0-7 and < 8.0.4 Roughly corresponding to Proxmox VE 7.0 up to and...
-
ProxmoxSecurityAdvisory replied to the thread Proxmox Virtual Environment - Security Advisories.Subject: PSA-2026-00042-1: missing privilege checks for vzdump stop API calls Advisory date: 2026-08-17 Packages: pve-manager Details: Any authenticated user/API token could trigger a stop of running backups. This issue was reported...