EUVD-2026-45180
GHSA-66cj-jqwq-x892
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
XXE reached through the authenticated Proxmox management API implies PR:L; impact is chiefly arbitrary file disclosure (C:H) with limited DoS (A:L) and no direct integrity change (I:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability.
AnalysisAI
XML External Entity injection in the libpve-storage-perl library (the storage-management Perl backend of Proxmox VE) affects builds identified as libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7, per MITRE. An attacker able to submit crafted XML to an affected storage-handling code path can force the parser to resolve external entities, enabling arbitrary local file disclosure and potential SSRF or denial of service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to reach a code path in libpve-storage-perl that parses attacker-supplied XML - i.e., an affected version (reported as libpve-storage-perl 8.3.7 / libpvestorage-perl 9.1.1) with a storage or configuration operation that ingests XML. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, base 9.8) portrays a remote, unauthenticated, trivially exploitable flaw with full CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can submit a crafted XML payload to an affected libpve-storage-perl code path (for example via an authenticated Proxmox API/UI storage operation that accepts XML input) includes an external entity referencing a local file such as /etc/pve/priv or /etc/passwd; the parser resolves it and returns the file contents to the attacker, or issues an outbound request to an internal host (SSRF). No public POC is referenced, but the low attack complexity means a working exploit would be straightforward for anyone with access to the vulnerable endpoint. |
| Remediation | No exact vendor-released fixed version is present in the supplied data; consult the Proxmox VE security advisory thread (https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/post-849970) and upgrade libpve-storage-perl to the patched package once the maintainers publish it via the standard Proxmox APT repositories (Patch available per vendor advisory; released patched version not independently confirmed from this data). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Proxmox VE deployments and identify systems running libpve-storage-perl v9.1.1 or v8.3.7, then restrict storage management interface access to trusted networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Share
External POC / Exploit Code
Leaving vuln.today