CVE-2025-57539 Details
Description
A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks.
A stored cross-site scripting vulnerability has been identified in Proxmox Virtual Environment (PVE) version 8.4. This vulnerability allows authenticated users to inject malicious scripts into the U2F Origin field within the Datacenter configuration. The injected scripts are not properly sanitized, enabling them to be executed in the Web UI context of other users who view the same settings. This could lead to session hijacking or other malicious activities.
Users can upgrade to Proxmox Virtual Environment 9.0.5 or 8.4.11, both of which include the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 10, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss | CISA-ADP | ExploitThird Party Advisory |
| https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010 | [email protected] | Issue TrackingVendor Advisory |
| https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xss | [email protected] | ExploitThird Party Advisory |
| https://www.youtube.com/watch?v=-wvkN-7oT5U | [email protected] | Broken Link |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| proxmox virtual environment | 8.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2025 | Initial Analysis | [email protected] |
| Sep 10, 2025 | CVE Modified | CISA-ADP |
| Sep 9, 2025 | New CVE Received | [email protected] |