CVE-2026-51081
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and 8.x 4.3.16 allows attackers to inject malicious scripts or HTML. The flaw exists in input handling, enabling arbitrary code execution in the victim's browser.
Risk Assessment
An attacker could hijack an admin session, steal credentials, or modify virtualization environment configuration. The risk is high due to PVE's critical role in IT infrastructure management.
Recommendation
Immediately update Proxmox VE to the latest patched version. Additionally, implement input filtering and restrict admin panel access to trusted IP addresses.
Other vulnerabilities in Proxmox Virtual Environment
See all- CVE-2022-31358Critical
A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.
- CVE-2026-51083Medium
Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users with limited privileges to obtain hashed passwords via the cloudinit/dump API.
- CVE-2026-51082High
A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x and 8.x allows an attacker with privileges to call vncproxy to hijack a VNC session established in parallel by a different user for a different VM.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.