PMG: Bypass of mail filters by crafted boundary parameters
Affected packages
pmg-api, libmime-tools-perl
Details
Certain problematic strings used as Content-Type boundaries were not covered by the fixes for PSA-2026-00005-1. With a fitting boundary the parser could be tricked into treating a malicious attachment as epilogue to a multipart message and skipping the checks on the part.
Some mail user agents display such parts hidden in the epilogue as attachments, potentially exposing users to unwanted and dangerous content.
This issue was privately reported by Artem Danilov of Positive Technologies.
Fixed in
- libmime-tools-perl >= 5.515-1+pmg2
References
- PSA-2026-00005-1 was about a similar issue.
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.