Proxmox vulnerabilities
We track 4 vulnerabilities in Proxmox products across 10 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 25, 2024.
Latest Proxmox vulnerabilities
- 8.2 High severity
pve-manager: External Control of File Name or Path
Proxmox Virtual Environment is an open-source server management platform for enterprise virtualization. Insufficient safeguards against malicious API response values allow authenticated attackers with 'Sys.Audit' or 'VM.Monitor' privileges to download arbitrar
- 9.0 Critical severity
Virtual Environment: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.
- 9.8 Critical severity
Proxmox Mail Gateway: Server-Side Request Forgery
Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure
- 7.1 High severity
Proxmox Mail Gateway: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side D