Authenticated Remote Code Execution via shell injection
Betroffene Pakete
pmg-api
Details
Missing separation between options and package name arguments in an apt-get invocation exposed over the API allowed an authenticated attacker with Sys.Audit privileges to inject arbitrary options into the resulting apt-get command line. Such an attacker could inject options that trigger arbitrary code execution as www-data.
The vulnerable API endpoint is only available to authenticated admin users, quarantine-level access does not allow exploiting it.
This issue was found and reported by Kevin Joensen <[email protected]> from Baldur Security.
Behoben in
pmg-api >= 8.2.7 (PMG 8.x), pmg-api >= 9.0.3 (PMG 9.x)
Referenzen
Advisories PSA-2026-00002-1, PSA-2026-00003-1, and PSA-2026-00004-1 all address similar issues in other Proxmox projects.
Diese Seite ist eine inoffizielle Kopie des offiziellen Beitrags im Proxmox-Forum (öffnet in neuem Tab). Prüfe vor jeder Maßnahme das Original. Der Text des Advisories wird so auf Englisch angezeigt, wie Proxmox ihn veröffentlicht hat.