Pmg Api
Monthly
Argument injection in Proxmox Mail Gateway's pmg-api package changelog retrieval functionality lets an attacker with an authenticated high-privileged session, or an attacker who can induce a logged-in PMG administrator to make a CSRF-style request, supply malicious arguments to the underlying apt-get command. The issue is classified as CWE-88 and tracked at CVSS 4.4 with high attack complexity, required administrative privileges, low confidentiality and integrity impact, and a scope change; no public exploit identified at time of analysis. Exploitation is limited to Proxmox Mail Gateway deployments and, in the CSRF variant, requires administrator interaction, making real-world risk low-to-moderate despite the network attack vector.
Argument injection in Proxmox Mail Gateway's pmg-api package changelog retrieval functionality lets an attacker with an authenticated high-privileged session, or an attacker who can induce a logged-in PMG administrator to make a CSRF-style request, supply malicious arguments to the underlying apt-get command. The issue is classified as CWE-88 and tracked at CVSS 4.4 with high attack complexity, required administrative privileges, low confidentiality and integrity impact, and a scope change; no public exploit identified at time of analysis. Exploitation is limited to Proxmox Mail Gateway deployments and, in the CSRF variant, requires administrator interaction, making real-world risk low-to-moderate despite the network attack vector.