Proxmox
By Proxmox Server Solutions GmbH Vulnerability disclosure program on Self-hosted proxmox.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 4
- Public CVEs
- 13
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Pays cash
-
No
Proxmox Server Solutions GmbH currently does not offer paid bug bounties.
- Response
-
Within 1 days
We will normally send out an initial confirmation mail about the reception of a report within the next (Austrian) business day.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test.
Domains 1
- proxmox.com
Products and areas 3
- Proxmox Backup Server
- Proxmox Mail Gateway
- Proxmox VE
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Proxmox's policy. "We" in these lines means the program, not this site.
While testing
-
before reporting, please verify that the issue is present in a release that is still supported
-
Include all relevant information required to reproduce the issue.
-
Please send plain text emails without attachments where possible.
-
Any exploit code is considered helpful - we will treat such samples as private and won't publish them.
Not accepted
-
problems found by automatic scanners are often either outdated practices or have little practical impact
-
Some scanners also report our email settings as problematic (e.g., missing DMARC)
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-51080 | libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability. | Critical 9.8 | 17 Jul 2026 |
| CVE-2025-57539 | A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks. | Medium 5.4 | 9 Sep 2025 |
| CVE-2025-57540 | A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks. | Medium 5.4 | 9 Sep 2025 |
| CVE-2025-57538 | A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject malicious input. The input is stored and executed in the context of other users' browsers when they view the affected configuration page. This can lead to arbitrary JavaScript execution. | Medium 5.4 | 9 Sep 2025 |
| CVE-2023-46854 | Proxmox proxmox-widget-toolkit before 4.0.9, as used in multiple Proxmox products, allows XSS via the edit notes feature. | Medium 5.4 | 28 Oct 2023 |
| CVE-2023-43320 | An issue in Proxmox Server Solutions GmbH Proxmox VE v.5.4 thru v.8.0, Proxmox Backup Server v.1.1 thru v.3.0, and Proxmox Mail Gateway v.7.1 thru v.8.0 allows a remote authenticated attacker to escalate privileges via bypassing the two-factor authentication component. | High 8.8 | 27 Sep 2023 |
| CVE-2022-31358 | A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/. | Critical 9.0 | 14 Dec 2022 |
| CVE-2022-35507 | A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker to set cookies for a victim's browser that are longer than the server expects, causing a client-side DoS. This affects Chromium-based browsers because they allow injection of response headers with %0d. This is fixed in pve-http-server 4.1-3. | High 7.1 | 4 Dec 2022 |
| CVE-2022-35508 | Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox Mail Gateway, privilege escalation to the root@pam account is possible if the backup feature h | Critical 9.8 | 4 Dec 2022 |
| CVE-2014-4156 | Proxmox VE prior to 3.2: 'AccessControl.pm' User Enumeration Vulnerability | Medium 5.3 | 27 Jan 2020 |
| CVE-2015-9057 | Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allow remote attackers to inject arbitrary web script or HTML via multiple parameters, related to /users/index.htm, /quarantine/spam/manage.htm, /quarantine/spam/whitelist.htm, /queues/mail/index/, /system/ssh.htm, /queues/mail/?domain=, and /quarantine/virus/manage.htm. | Medium 6.1 | 3 May 2017 |
| CVE-2015-9058 | Open redirect vulnerability in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter. | Medium 6.1 | 3 May 2017 |
| CVE-2014-2325 | Multiple cross-site scripting (XSS) vulnerabilities in Proxmox Mail Gateway before 3.1-5829 allow remote attackers to inject arbitrary web script or HTML via the (1) state parameter to objects/who/index.htm or (2) User email address to quarantine/spam/manage.htm. | Medium 4.3 | 14 Mar 2014 |