CVE-2025-57540

MEDIUM severity · CVSS 5.4 · Cross-site scripting (XSS)

5.4CVSS MEDIUM

Summary

A stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field within the Datacenter configuration of Proxmox Virtual Environment (PVE) 8.4. Authenticated users can inject JavaScript code that is later executed in the browsers of users who view the configuration page, enabling client-side attacks.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

Confidentiality impactLow

Integrity impactLow

Availability impactNone

Exploit probability (EPSS)0%

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products we track (1)

Proxmox VE

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://forum.proxmox.com/threads/proxmox-virtual-environment-security-advisories.149331/page-2#post-792010Advisory
https://www.youtube.com/watch?v=-wvkN-7oT5U
https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xssAdvisory
https://github.com/khankishiyev-j/bug-bounty/blob/main/proxmox-xssAdvisory