Command injection via import of malicious OVA file
Affected packages
libpve-storage-perl, qemu-server
Details
Insufficient restrictions of OVA member file names allowed an attacker with sufficient privileges to upload and import OVA files to inject arbitrary arguments into a tar invocation executed as root.
This issue was found and reported privately by Project Loupe.
Fixed in
- libpve-storage-perl >= 9.1.11
This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.