CVE-2025-57538: Proxmox Virtual Environment XSS Vulnerability

CVE-2025-57538 Overview

CVE-2025-57538 is a stored cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment (PVE) 8.4. The flaw resides in the HTTP Proxy field within the Datacenter configuration panel. An authenticated user can inject malicious input that persists in the server configuration. When other users load the affected configuration page, the payload executes in their browser context. Successful exploitation results in arbitrary JavaScript execution within the Proxmox web interface. The vulnerability is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
An authenticated attacker with configuration access can hijack administrator sessions, perform actions on behalf of victims, or pivot to management of virtualized infrastructure through the Proxmox web UI.

Affected Products

Proxmox Virtual Environment 8.4
Datacenter configuration panel (HTTP Proxy field)
Proxmox web management interface

Discovery Timeline

2025-09-09 - CVE-2025-57538 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57538

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the Datacenter options interface of Proxmox VE 8.4. The HTTP Proxy configuration field accepts user-supplied input without sufficient output encoding when the value is later rendered to other administrators. Because the payload is persisted server-side in the Datacenter configuration, it fires automatically whenever a user with access to the configuration panel loads the view.

Exploitation requires an authenticated account with permission to modify Datacenter settings. Because the injected script executes in a privileged administrative UI, an attacker can leverage the victim's session to perform virtualization management actions, including modifying virtual machines, altering user accounts, or extracting sensitive tokens visible to the browser.

Root Cause

The root cause is missing input sanitization and output escaping on the HTTP Proxy configuration parameter. The Proxmox web UI reflects the stored value into the rendered page without neutralizing HTML or JavaScript syntax. This matches the pattern described in [CWE-79], where untrusted input is embedded in web output without proper encoding.

Attack Vector

The attack vector is network-based and requires authentication plus user interaction from a victim who loads the configuration page. An attacker submits a crafted payload into the HTTP Proxy field through the Datacenter panel. The payload is stored in the Proxmox configuration and executed in the browser of any subsequent administrator viewing that page. Refer to the Proxmox Forum Security Advisories and the GitHub Bug Bounty Report for technical proof-of-concept details.

Detection Methods for CVE-2025-57538

Indicators of Compromise

Unexpected HTML tags, <script> elements, or JavaScript event handlers stored in the Datacenter HTTP Proxy configuration value.
Outbound requests from administrator browsers to unknown domains shortly after loading the Proxmox Datacenter panel.
Modifications to /etc/pve/datacenter.cfg containing non-URL characters in the http_proxy field.

Detection Strategies

Audit the current value of the http_proxy setting in /etc/pve/datacenter.cfg and validate that it conforms to a URL format.
Review Proxmox audit logs for PUT requests to the Datacenter options API endpoint from unexpected user accounts.
Inspect browser network telemetry for anomalous script loads originating from the Proxmox management UI origin.

Monitoring Recommendations

Enable and forward Proxmox web UI access logs to a centralized log platform for correlation.
Alert on configuration changes to Datacenter options made outside approved change windows.
Monitor administrator workstations for unusual outbound traffic when accessing the Proxmox console.

How to Mitigate CVE-2025-57538

Immediate Actions Required

Inspect the http_proxy value in /etc/pve/datacenter.cfg and remove any content that is not a valid proxy URL.
Restrict Datacenter configuration permissions to a minimal set of trusted administrators using Proxmox role-based access control.
Rotate API tokens and session credentials for any account that may have loaded a tampered configuration page.

Patch Information

Consult the Proxmox Forum Security Advisories for the fixed package versions and update instructions. Apply the vendor updates through the standard apt update && apt dist-upgrade procedure on all Proxmox VE 8.4 nodes.

Workarounds

Limit the Sys.Modify and Datacenter-level configuration privileges to a narrow group of vetted administrators until patching is complete.
Place the Proxmox web interface behind a reverse proxy that enforces a strict Content Security Policy to reduce the impact of injected scripts.
Require administrators to access the Proxmox UI from dedicated hardened workstations that do not hold sensitive credentials in the browser.

bash

# Configuration example: review and sanitize the stored HTTP proxy value
grep -E '^http_proxy' /etc/pve/datacenter.cfg

# Remove a tampered value (edit and re-save through the web UI or CLI)
pvesh set /cluster/options --delete http_proxy