CVE-2026-51080

Name of the Vulnerable Software and Affected Versions libpvestorage-perl version 9.1.1 libpve-storage-perl version 8.3.7

Description An XML External Entity (XXE) flaw exists in the storage Perl components of Proxmox VE. This issue stems from insecure XML parsing caused by improper parser configuration and input validation, which allows external entity resolution. An attacker can exploit this by providing crafted XML to any reachable code path that parses attacker-influenced XML, such as API or UI-driven operations, import/metadata handling, or integrations. Successful exploitation can lead to the disclosure of sensitive local files and potentially enable Server-Side Request Forgery (SSRF), which allows an attacker to make requests from the server to internal network resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.