CVE-2025-57539

MEDIUM severity · CVSS 5.4 · Cross-site scripting (XSS)

5.4CVSS MEDIUM

Summary

A stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially leading to session hijacking or other attacks.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

Confidentiality impactLow

Integrity impactLow

Availability impactNone

Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products we track (1)

Proxmox VE

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010Advisory
https://www.youtube.com/watch?v=-wvkN-7oT5U
https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xssAdvisory
https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xssAdvisory