CVE-2026-94588

Summary

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in a CSRF-style attack.

Affected Software

VendorProductVersion RangeStatus
Proxmoxpmg-api0 < 8.2.7unaffected
Proxmoxpmg-api9.0.0 < 9.0.3affected

Weaknesses

  • CWE-88: CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

References