CVE-2026-94588

Proxmox / pmg-api PUBLISHED

Description (CNA)

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in a CSRF-style attack.

Affected (CNA)

Vendor / product	Versions
Proxmox / pmg-api	unaffected 0 before 8.2.7; affected 9.0.0 before 9.0.3

CWE

CWE-88

References

https://forum.proxmox.com/threads/proxmox-mail-gateway-security-advisories.149333/post-831054

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.