CVE-2022-31358: Proxmox Virtual Environment

Critical severity, CVSS 9.0. EPSS: 1.3% chance of exploitation in the next 30 days.

A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.

Affected products

• Proxmox Virtual Environment: before 7.2-3 (fixed in 7.2-3)

Published 2022-12-14. Last modified 2026-07-09.