PMG: XSS in filename display in attachment quarantine
Affected packages
pmg-gui
Details
The filename field in the AttachementGrid component shown in the Attachment Quarantine view takes its data from the Content-Disposition header of the quarantined mail. The display field was not HTML-encoded allowing for an attacker to launch an XSS attack by sending a mail with prepared attachments.
The issue was privately reported by Điềm from VNPT-VCI.
Fixed in
- pmg-gui >= 5.2.3
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.