CVE-2022-35508

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-04 · updated 2026-06-17
Weakness: CWE-918

Description

Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. An attacker with an unprivileged account can craft an HTTP request to achieve SSRF and file disclosure of any files on the server. Also, in Proxmox Mail Gateway, privilege escalation to the root@pam account is possible if the backup feature has ever been used, because backup files such as pmg-backup_YYYY_MM_DD_*.tgz have 0644 permissions and contain an authkey value. This is fixed in pve-http-server 4.1-3.

Affected products

Proxmox Mail Gateway: all versions
Proxmox Pve Http Server: before 4.1-3 — fixed in 4.1-3
Proxmox Virtual Environment: all versions

How to fix

Upgrade to a fixed version: Proxmox Pve Http Server 4.1-3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-35508 or the next vulnerability affects your stack