Proxmox Backup Server security advisories
Every advisory Proxmox has published in the forum, with packages, fixed versions and CVSS scores.
- Missing privilege checks when configuring scheduled tape backup jobs
proxmox-backup-server
–No score - Missing validation of chunk sizes during pull sync
proxmox-backup-server
–No score - Missing privilege checks when removing namespace from prune job
proxmox-backup-server
–No score - S3-Refresh path escape issue
proxmox-backup-server
–No score - Missing privilege checks for local sync jobs
proxmox-backup-server
–No score - Missing privilege checks in GC status API
proxmox-backup-server
–No score - Incomplete validation of sync encryption/decryption key access
proxmox-backup-server
–No score - Out-of-bounds read when processing malformed fixed-size index file
proxmox-backup-server
–No score - pxar/container restore target rootfs escape
pve-container, proxmox-backup-client, rust-pxar
–No score - integrity bypass of encrypted backups on an untrusted PBS instance
proxmox-backup-client, proxmox-backup-file-restore, libproxmox-backup-qemu0
–No score - ACME directory ToS URL XSS
proxmox-backup, proxmox-widget-toolkit
–No score - missing filename reference validation in backup manifests
proxmox-backup-server
–No score - "Crackarmor" apparmor vulnerabilities
proxmox-kernel-*
–No score - Log poisoning via crafted HTTP Forwarded header
proxmox-backup-server
–No score - User Enumeration Vulnerability in Proxmox Backup Server API Token Authentication
proxmox-backup-server
–No score - Authenticated Remote Code Execution via shell injection
proxmox-backup-server
–No score - Missing protections against malicious backup clients with S3-backed datastores
proxmox-backup-server
–No score - Race condition during long-running garbage collection and pruning of recent snapshots may lead to back up corruption before Proxmox Backup Server 3.4
proxmox-backup-server
–No score - Spectre branch target injection from VM guests ("VMScape")
proxmox-kernel-6.8, proxmox-kernel-6.14
CVE-2025-40300
5.5Medium - stored XSS in config values
proxmox-backup-server
–No score - Incomplete exclusion of the NTFS module in Grub2 with Secure Boot
grub-efi-amd64-signed 1+2.06+13+pmx6
–No score - Various SecureBoot bypasses, data integrity violations and sensitive data leaks in Grub
grub-pc-bin, grub-efi-amd64-bin, grub-efi-amd64-signed, grub-efi-amd64-unsigned
CVE-2024-45774, CVE-2024-45775, CVE-2024-45776, CVE-2024-45777, CVE-2024-45778,…
7.8High - Proxmox Backup Server: unauthenticated DOS vulnerability
proxmox-backup-server (== 3.2.8-1, pbstest and pbs-no-subscription only)
–No score - Shim bootloader remote code execution via http response
shim-unsigned, shim-signed
CVE-2023-40546, CVE-2023-40547, CVE-2023-40548, CVE-2023-40551
8.3High - Tape backup drive encryption failure
proxmox-backup-server
–No score