Argument Injection Vulnerability in Proxmox pmg-api Affecting Proxmox Mail Gateway

CVE-2026-94588

What is CVE-2026-94588?

In Proxmox Mail Gateway's pmg-api component, an argument injection vulnerability exists in the changelog retrieval feature. This issue arises from the improper handling of user-supplied input when executing the underlying apt-get command. While it requires user authentication, the vulnerability can be exploited through CSRF-style attacks, potentially allowing unauthorized access to sensitive package changelogs.

References