Proxmox VE (libpve-storage-perl XXE): XML external entity injection in the Proxmox storage library, reachable

Impact

XML external entity injection in the Proxmox storage library, reachable unauthenticated, leading to full compromise. Proxmox is increasingly used as the hypervisor for smaller GPU clouds where vSphere licensing does not pencil out.

Who can reach it

Unauthenticated network access to the affected Proxmox service.

What to do

Upgrade libpve-storage-perl past v9.1.1 / v8.3.7 via the Proxmox enterprise or no-subscription repo. Package update plus service restart; no VM downtime required.

References