CVE-2025-57538 Details
Description
A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject malicious input. The input is stored and executed in the context of other users' browsers when they view the affected configuration page. This can lead to arbitrary JavaScript execution.
A stored cross-site scripting vulnerability has been identified in Proxmox Virtual Environment (PVE) version 8.4. This vulnerability resides in the HTTP Proxy field within the Datacenter configuration panel. It allows authenticated users to inject malicious scripts that are stored and executed in the context of other users' browsers when they access the affected configuration page. This could lead to the execution of arbitrary JavaScript, potentially allowing for session hijacking or further exploitation.
Users can update to Proxmox Virtual Environment 9.0.5 or 8.4.11, both of which include the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss | CISA-ADP | ExploitThird Party Advisory |
| https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010 | [email protected] | Issue TrackingVendor Advisory |
| https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss | [email protected] | ExploitThird Party Advisory |
| https://www.youtube.com/watch?v=mN-0Zia1LZw | [email protected] | Broken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| proxmox virtual environment | 8.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2025 | Initial Analysis | [email protected] |
| Sep 10, 2025 | CVE Modified | CISA-ADP |
| Sep 9, 2025 | New CVE Received | [email protected] |