Recent content by ProxmoxSecurityAdvisory

Subject: PSA-2026-00066-1: ESXi importer: path traversal in vmx parser Advisory date: 2026-10-12 Packages: libpve-storage-perl Details: Incomplete path validation in the ESXi importer allowed an attacker with access to a configured ESXi instance with privileges to trigger imports to leak...

Subject: PSA-2026-00065-1: PMG: Bypass DMARC check by spoofed envelope sender header Advisory date: 2026-10-07 Packages: pmg-api Details: Adding a X-Proxmox-Envelope-From header to a mail confuses pmg-smtp-filter into using the mail-address there, instead of the actual envelope sender for...

Subject: PSA-2026-00064-1: PMG: Administrator to root privilege escalation via private keys in backup Advisory date: 2026-10-07 Packages: pmg-api Details: A user with Administrator role could create and download a backup, which includes the private key material for the API server. This can...

Subject: PSA-2026-00063-1: PMG: Administrator to root privilege escalation via http_proxy configuration setting Advisory date: 2026-10-07 Packages: pmg-api Details: Insufficient input validation for the http_proxy configuration setting allowed an attacker with Administrator role to inject...

Subject: PSA-2026-00062-1: Missing privilege checks when configuring scheduled tape backup jobs Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: A user with sufficient privileges to set up a tape backup job could reference any datastore or tape media pool/drive in the...

Subject: PSA-2026-00061-1: Missing validation of chunk sizes during pull sync Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: An attacker with control over a pull source (or its raw index contents) could trick the pull target into storing an index file with an invalid...

Subject: PSA-2026-00060-1: Missing privilege checks when removing namespace from prune job Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: The required privileges were not checked correctly when removing the configured namespace from an existing prune job. This issue was...

Subject: PSA-2026-00059-1: pxar/container restore target rootfs escape Advisory date: 2026-10-07 Packages: pve-container, proxmox-backup-client, rust-pxar Details: An attacker with direct access to a PBS datastore configured as storage on a Proxmox VE host can construct and upload a...

Subject: PSA-2026-00059-1: pxar/container restore target rootfs escape Advisory date: 2026-10-07 Packages: pve-container, proxmox-backup-client, rust-pxar Details: An attacker with direct access to a PBS datastore configured as storage on a Proxmox VE host can construct and upload a...

Subject: PSA-2026-00058-1: S3-Refresh path escape issue Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: Incomplete validation of an S3 object key returned by a configured S3 endpoint allowed an attacker with control over the S3 server to overwrite arbitrary host paths as...

Subject: PSA-2026-00057-1: Missing privilege checks for local sync jobs Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: An attacker with highly privileged access to one datastore + namespace could set up a "local" sync job pulling from arbitrary datastores. This issue was...

Subject: PSA-2026-00056-1: Missing privilege checks in GC status API Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: Missing privilege checks in the GC status API endpoint at /api2/json/admin/gc/{store} allowed an authenticated attacker without sufficient privileges to...

Subject: PSA-2026-00055-1: Incomplete validation of sync encryption/decryption key access Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: An attacker with Datastore.Modify or Datastore.Read on a datastore + namespace can configure sync jobs with arbitrary owners. The sync...

Subject: PSA-2026-00054-1: Out-of-bounds read when processing malformed fixed-size index file Advisory date: 2026-10-07 Packages: proxmox-backup-server Details: Missing overflow checks when handling the index and chunk size of a fixed-size index could cause a wrong size to be used for...

Subject: PSA-2026-00053-1: PBS backup access includes host/NNN groups Advisory date: 2026-10-01 Packages: libpve-storage-perl Details: If a configured PBS storage contained backup groups with type host, but numerical backup IDs, such snapshots were treated like guest backups despite their...