CVE-2026-51080

22th percentile - higher than 22% of all known CVEs

An XML External Entity (XXE) vulnerability was discovered in libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7. It allows an attacker to load external XML entities, potentially leading to file disclosure or unauthorized requests.

The risk involves potential reading of sensitive system files by an attacker, which could result in data leakage or privilege escalation in the Proxmox VE environment.

Immediately update libpvestorage-perl to a version newer than 9.1.1 and libpve-storage-perl to a version newer than 8.3.7, and disable external entity processing in XML configuration.