PMG: XSS in content-type display in quarantine views
Affected packages
pmg-gui
Details
The Filetype field in the AttachementGrid component shown in the quarantine views takes the data from the Content-Type header of the quarantined mail. The display field was not HTML-encoded allowing for an attacker to launch an XSS attack by sending a mail with prepared attachments.
The issue was found internally.
Fixed in
pmg-gui (>= 5.2.4)
References
- PSA-2026-00048-1 was about a similar issue
This page reproduces the official Proxmox forum post (opens in a new tab). The original is authoritative.