CVE-2025-57538: XSS
A stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter configuration panel of Proxmox Virtual Environment (PVE) 8.4 allows an authenticated user to inject malicious input. The input is stored and executed in the context of other users' browsers when they view the affected configuration page. This can lead to arbitrary JavaScript execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-57538?
CVE-2025-57538 is classified with a high severity due to its ability to allow attackers to execute malicious scripts in the context of other users' browsers.
How do I fix CVE-2025-57538?
To fix CVE-2025-57538, ensure that your Proxmox Virtual Environment is updated to the latest version where the vulnerability is patched.
What type of vulnerability is CVE-2025-57538?
CVE-2025-57538 is a stored cross-site scripting (XSS) vulnerability affecting the HTTP Proxy field in Proxmox Virtual Environment.
Who is affected by CVE-2025-57538?
Authenticated users of Proxmox Virtual Environment 8.4 are affected by CVE-2025-57538 if they can inject malicious input into the configuration panel.
What can attackers do with CVE-2025-57538?
Attackers can exploit CVE-2025-57538 to inject malicious scripts that execute in the browsers of other users who view the compromised configuration.