CVE-2026-51081
Received Received - Intake

Cross-Site Scripting (XSS) in Proxmox Virtual Environment

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: MITRE

Description
A cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 9.x 5.1.8 and Proxmox Virtual Environment (PVE) 8.x 4.3.16 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-17
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-51081
EUVD
EUVD-2026-45181

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
proxmox virtual_environment to 5.1.8 (inc)
proxmox virtual_environment to 4.3.16 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) versions 9.x 5.1.8 and 8.x 4.3.16. Attackers can inject malicious scripts or HTML into web pages viewed by users, potentially stealing data or performing unauthorized actions.

Detection Guidance

This vulnerability is specific to Proxmox Virtual Environment (PVE) versions 9.x 5.1.8 and 8.x 4.3.16. To detect it, check your Proxmox version using the command 'pveversion'. If your version matches the affected ones, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code in your browser when accessing Proxmox VE. This may lead to session hijacking, data theft, or unauthorized access to your virtual environment.

Compliance Impact

This XSS vulnerability could potentially expose sensitive data processed by Proxmox Virtual Environment, which may impact compliance with GDPR (data protection) and HIPAA (healthcare data privacy) if exploited to steal or manipulate user sessions or data.

Mitigation Strategies

Update Proxmox Virtual Environment to the latest patched versions (PVE 9.x 5.1.8 or later and PVE 8.x 4.3.16 or later) to address the XSS vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51081. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart