Authenticated Remote Code Execution via shell injection

Details

Missing separation between options and package name arguments in an apt-get invocation exposed over the API allowed an authenticated attacker with Sys.Audit privileges to inject arbitrary options into the resulting apt-get command line. Such an attacker could inject options that trigger arbitrary code execution as www-data.

The vulnerable API endpoint is only available to authenticated admin users, quarantine-level access does not allow exploiting it.

This issue was found and reported by Kevin Joensen <[email protected]> from Baldur Security.

Fixed in

pmg-api >= 8.2.7 (PMG 8.x), pmg-api >= 9.0.3 (PMG 9.x)

References

Advisories PSA-2026-00002-1, PSA-2026-00003-1, and PSA-2026-00004-1 all address similar issues in other Proxmox projects.