Missing shell quoting in upload error handling
Affected packages
libpve-storage-perl
Details
Missing shell quoting while handling transfer failures during file upload handling could allow an attacker to execute arbitrary commands as root on the PVE node.
This issue was found internally.
Fixed in
- libpve-storage-perl >= 9.1.15
This page reproduces the official Proxmox forum post (opens in a new tab). The original is authoritative.