Executive brief
Proxmox Virtual Environment, a platform for managing virtual machines and containers, is affected by a security flaw in its web management interface. An attacker with administrative privileges could inject malicious scripts into configuration settings for HTTP proxies or authentication methods. If another administrator views these settings, the script could execute in their browser, potentially leading to unauthorized actions or session hijacking.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the pve-manager component of Proxmox Virtual Environment. The vulnerability is located in the dialogues for HTTP proxy, WebAuthN, and U2F settings. An attacker requires 'Sys.Modify' privileges on the root ACL path ('/') to exploit this, which is typically restricted to the Administrator role. By injecting a malicious payload into these configuration fields, the script is stored and later executed in the context of any user who views those settings. The issue is resolved in pve-manager versions 9.0.5 and 8.4.11.
Affected products
- Proxmox Proxmox Virtual Environment (PVE) 9.x pve-manager < 9.0.5
- Proxmox Proxmox Virtual Environment (PVE) 8.x pve-manager < 8.4.11
Timeline
- 2025-08-14: advisory: Proxmox internal advisory PSA-2025-00013-1 released
- 2026-07-17: disclosed: CVE-2026-51081 published