Loading story…
Researchers disclosed three vulnerabilities affecting Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG), including a post-authentication reflected XSS in PVE’s API Inspector, a CRLF injection flaw in HTTP error handling, and a post-authentication SSRF plus arbitrary file-read issue shared across both products. The XSS bug, tracked as CVE-2022-31358, could let an authenticated attacker run JavaScript in a logged-in administrator’s browser and potentially abuse exposed web UI functions to execute actions on the host. The CRLF injection issue could be exploited in Chromium-based browsers to inject headers and trigger a client-side denial of service by forcing oversized cookie headers that lock users out of the web interface.
The most serious finding was a bug chain in PVE and PMG that allowed low-privileged authenticated users to abuse SSRF and arbitrary file read; in PMG, attackers could also access backup archives containing the authentication private key, forge valid tickets, and escalate privileges to root@pam. MITRE assigned CVE-2022-35507 and CVE-2022-35508 to the latter flaws. Proxmox addressed the XSS in pve-http-server 4.1-2 and patched the CRLF injection and SSRF-related issues in pve-http-server 4.1-3.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
STAR Labs published technical details on three vulnerabilities affecting Proxmox VE and Proxmox Mail Gateway, including reflected XSS, CRLF injection, and an SSRF plus arbitrary file-read chain. The disclosure explained how low-privileged authenticated users could abuse the issues, including a PMG privilege-escalation path via readable backup files.
MITRE assigned CVE-2022-31358 to the reflected XSS issue and later assigned CVE-2022-35507 and CVE-2022-35508 to the remaining CRLF injection and SSRF/file-read vulnerabilities. These identifiers formalized tracking for the three disclosed bugs.
Proxmox released pve-http-server version 4.1-3 to address a CRLF injection flaw in HTTP error handling and a post-authentication SSRF plus arbitrary file-read bug affecting Proxmox VE and Proxmox Mail Gateway. In PMG, the file-read issue could expose backup archives containing authentication keys, enabling privilege escalation to root@pam.
Proxmox fixed a post-authentication reflected XSS issue in the Proxmox VE API Inspector in pve-http-server version 4.1-2. The flaw could allow JavaScript execution in an authenticated administrator's browser and potentially lead to host-level actions through the web UI.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German CERT published two advisories affecting **Proxmox Virtual Environment (PVE)**, including one issue that can lead to **information disclosure** and a later notice covering **multiple vulnerabilities** in the virtualization platform. The advisories, `2026-1012` and `2026-1243`, indicate that organizations running Proxmox should review exposed management infrastructure and assess whether sensitive data or administrative functions could be affected. The notices provide limited public detail, but the combination of an information disclosure flaw and additional unspecified weaknesses raises concern for enterprises using Proxmox to host virtual machines and manage clustered infrastructure. Security teams should identify all PVE deployments, monitor vendor and CERT updates for affected versions and patches, and prioritize remediation or compensating controls on internet-reachable or business-critical systems.
Jun 29, 2026
Researchers disclosed multiple critical vulnerabilities in the **SEPPMail Secure E-Mail Gateway** that can let attackers achieve remote code execution, read arbitrary files and emails, and maintain persistent control of the appliance. InfoGuard Labs said the exposed web UI and newer **GINA v2** interface are affected, with the most severe issues including `CVE-2026-2743`, an authenticated path traversal in the Large File Transfer component that can be chained into arbitrary file write and code execution, `CVE-2026-44128`, an unauthenticated Perl injection leading to RCE, `CVE-2026-44127`, a local file inclusion and arbitrary file deletion flaw, and `CVE-2026-7864`, an information disclosure bug exposing environment variables through a debug endpoint. The researchers described a practical takeover path in which an attacker overwrites `/etc/syslog.conf` and triggers a syslog reload via log rotation to obtain a Perl-based reverse shell, giving full control of the gateway and access to all mail traffic. They warned that the product is widely deployed, particularly in the DACH region, with thousands of internet-exposed instances visible, making the flaws a potential entry point into internal networks. SEPPMail released fixes across versions **15.0.2.1**, **15.0.3**, and **15.0.4**, while public reporting highlighted that successful exploitation could expose sensitive email content and enable long-term compromise of affected organizations.
Jun 29, 2026
Multiple severe vulnerabilities in **SmarterMail** exposed internet-facing mail servers to compromise, including `CVE-2025-52691`, an unauthenticated arbitrary file upload flaw that can lead to immediate remote code execution, and `CVE-2026-23760`, an authentication bypass tied to the password reset API. Public reporting said `CVE-2025-52691` affected **Build 9406 and earlier**, carried a **CVSS 10.0** rating, and allowed attackers with network access to place files in arbitrary server locations and execute code with the privileges of the SmarterMail service. Advisories from Censys highlighted both issues, while a public GitHub proof-of-concept for `CVE-2026-23760` increased the risk of opportunistic exploitation. SmarterTools reportedly fixed the file upload vulnerability in **Build 9413**, with later builds available afterward, and security reporting warned that successful compromise of a mail gateway could expose customer email, credentials, and connected backend systems. The flaws were described as especially dangerous for hosting providers and organizations running exposed SmarterMail instances because they enable unauthenticated access paths that can quickly escalate to full server compromise.
Jun 29, 2026