← Back

CVE-2026-94588

nvd nist
Published: Sep 21, 2026Modified: Sep 22, 2026Deferred

JSON object

Loading...
4.4
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Exploitability: 1.3 / Impact: 2.7
Source: MITRE (Secondary)

Description

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in a CSRF-style attack.

Related CWEs

CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (1)

Source: cve@mitre.org

Timeline

No history available yet.