Description

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in a CSRF-style attack.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-09-21T21:17:22.343Z",
  "pubdate": "2026-09-21T21:17:22.343Z",
  "executiveSummary": "An argument injection vulnerability has been identified within the Proxmox pmg-api component, specifically residing in the functionality responsible for retrieving package changelogs.\nThe vulnerability arises from insufficient sanitization of user-supplied input before it is passed to the underlying apt-get command-line utility.\nAn attacker capable of triggering this functionality can manipulate command-line arguments to alter the execution flow of the apt-get process.\nWhile the vulnerability requires an authenticated session, the potential for exploitation via CSRF (Cross-Site Request Forgery) significantly lowers the barrier for an attacker, as they could potentially force an authenticated administrative user to trigger the malicious request.\nThe successful exploitation of this flaw could allow for unauthorized execution of command-line flags, potentially leading to information disclosure or further system compromise depending on the capabilities of the underlying apt-get environment.\nThis vulnerability highlights a critical risk regarding input validation in interfaces that interact with system-level command-line tools.",
  "technicalDetails": "The vulnerability is classified as an argument injection flaw within the pmg-api, affecting the logic that handles package changelog requests.\nThe root cause is the improper handling and insufficient sanitization of user-provided data that is subsequently concatenated into the command string executed via shell or system-level process invocation for apt-get.\nIn a standard execution flow, the application calls apt-get to fetch changelog information for a specific package. If the input parameters—intended to specify the package name or changelog version—are not correctly validated against a strict allow-list or properly escaped, an attacker can inject malicious flags that apt-get will interpret as legitimate command-line options.\nBecause apt-get supports various flags that can influence its behavior (such as targeting different repositories, redirecting output, or modifying configuration paths), the injection allows for behavior modification of the binary.\nThe exploitation vector is particularly concerning due to the potential for CSRF-style attacks. Since the vulnerability resides within the authenticated API, an attacker can craft a malicious web request or page that triggers the vulnerable endpoint when visited by an authenticated Proxmox Mail Gateway (PMG) administrator.\nUpon successful invocation, the web application passes the crafted input into the system call. The operating system's shell or the process spawning mechanism then interprets the injected flags alongside the intended command, resulting in the unintended execution path.\nPost-exploitation impact is contingent upon the flags supported by the version of apt installed on the host system. By chaining specific arguments, an attacker may force the system to perform operations that deviate from the expected changelog retrieval process, potentially accessing system files, triggering unexpected error states, or performing diagnostic functions that could reveal sensitive metadata to an attacker.\nThe vulnerability is limited by the execution context of the pmg-api service, which typically requires administrative privileges to perform package management operations, thereby making the potential impact equivalent to the privileges assigned to the service process itself."
}