Proxmox CVE

VMA extraction path escape

PSA-2026-00067-1 PVE

Affected packages

pve-qemu-kvm

Details

An attacker restoring a crafted VMA file could trigger overwrites of arbitrary host paths.

Note: writing "raw" VMA files is not possible via the PVE API or backup feature, but requires direct access to the filesystem where backup archives are stored.

This issue was found internally.

Fixed in

  • pve-qemu-kvm >= 11.1.1-2 (Qemu 11.1+)
  • pve-qemu-kvm >= 11.0.3-4 (Qemu 11.0)

This page is an unofficial copy of the official Proxmox forum post (opens in a new tab). Always check the original before acting.