Subject: PSA-2026-00100-1: Missing shell quoting in upload error handling
Advisory date: 2026-11-12
Packages: libpve-storage-perl
Details:
Missing shell quoting while handling transfer failures during file upload handling could allow an attacker to execute arbitrary commands as root on the PVE node.
This issue was found internally.
Fixed in:
- libpve-storage-perl >= 9.1.15