CVE-2026-51080 (CVSS 9.8) affects libpve-storage-perl v8.3.7/v9.1.1. Review NVD and update if running Proxmox: https://nvd.nist.gov/vuln/detail/CVE-2026-51080
via NVD Recent High CVSS
#CyberSecurity#InfoSec#Vulnerability#AI#MachineLearning https://t.co/Ia93kNCAza
Post summary
The tweet announces CVE‑2026‑51080, a high‑severity vulnerability (CVSS 9.8) affecting libpve‑storage‑perl v8.3.7/v9.1.1, and directs users to the NVD for details while recommending updates for Proxmox installations.
🚨 CRITICAL - Proxmox PVE storage Perl XML parser allows XXE data leak (CVE-2026-51080)
An XML External Entity (XXE) flaw has been identified in Proxmox VE’s storage Perl components libpvestorage-perl and libpve-storage-perl when handling XML content. The root cause is insecure XML parsing that allows external entity resolution due to improper parser configuration and input validation. An attacker can exploit this by supplying crafted XML to any reachable code path that parses attacker-influenced XML (e.g., via API/UI-driven operations, import/metadata handling, or integrations), requiring only the ability to get XML processed by the service. Successful exploitation can disclose sensitive local files and potentially enable SSRF-style access to internal network resources, escalating to broader compromise depending on what secrets are exposed.
👉 Affected: libpvestorage-perl 9.1.1; libpve-storage-perl 8.3.7 | No fix yet - treat as suspicious
Post summary
The release announces a critical XML External Entity flaw in Proxmox VE storage Perl components, allowing data leaks and potential SSRF, with no fix yet.
